Edit tour

Windows Analysis Report
WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

Overview

General Information

Sample name:	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi renamed because original name is a hash value
Original sample name:	WPS v76.23.66.msi
Analysis ID:	1475158
MD5:	8b1b9af08bc62e4608d21b5568c0a581
SHA1:	acc808accbb6897da328a1def679b42e198bf9e0
SHA256:	4bf33d5531fe319bed3d1550608ded652ef6b52437b6cc94d47a0d388f5bb03b
Tags:	msi
Infos:

Detection

FatalRAT, GhostRat, Nitol

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected FatalRAT

Yara detected GhostRat

Yara detected Nitol

AI detected suspicious sample

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Adds / modifies Windows certificates

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6496 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6664 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2896 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding AF7A5A98FCE59EB21923DEC3642535A5 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6516 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding FC7440F48901E81826ED2A23961C7067 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSI704E.tmp (PID: 6684 cmdline: "C:\Windows\Installer\MSI704E.tmp" /DontWait "C:\Users\user\AppData\Roaming\WPS.exe" MD5: B9545ED17695A32FACE8C3408A6A3553)

MSI706F.tmp (PID: 6340 cmdline: "C:\Windows\Installer\MSI706F.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe" MD5: B9545ED17695A32FACE8C3408A6A3553)

WPS.exe (PID: 7212 cmdline: "C:\Users\user\AppData\Roaming\WPS.exe" MD5: B52BA2B99108C496389AE5BB81FA6537)

WPS.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Roaming\WPS.exe" -upgradepower MD5: B52BA2B99108C496389AE5BB81FA6537)

thelper.exe (PID: 7224 cmdline: "C:\ProgramData\Microsoft\MF\thelper.exe" MD5: 17749F66292F190EF93652EB512C5AB7)

thelper.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\thelper.exe" MD5: 17749F66292F190EF93652EB512C5AB7)

thelper.exe (PID: 7232 cmdline: C:\ProgramData\Microsoft\MF\thelper.exe MD5: 17749F66292F190EF93652EB512C5AB7)

thelper.exe (PID: 7272 cmdline: C:\ProgramData\Microsoft\MF\thelper.exe MD5: 17749F66292F190EF93652EB512C5AB7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nitol		No Attribution	https://asec.ahnlab.com/en/44504/ https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ https://en.wikipedia.org/wiki/Nitol_botnet https://krebsonsecurity.com/tag/nitol/	https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: thelper.exe PID: 7224	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: thelper.exe PID: 7224	JoeSecurity_FatalRAT	Yara detected FatalRAT	Joe Security
Process Memory Space: thelper.exe PID: 7224	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: thelper.exe PID: 7232	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: thelper.exe PID: 7232	JoeSecurity_FatalRAT	Yara detected FatalRAT	Joe Security
Process Memory Space: thelper.exe PID: 7232	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: thelper.exe PID: 7272	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: thelper.exe PID: 7272	JoeSecurity_FatalRAT	Yara detected FatalRAT	Joe Security
Process Memory Space: thelper.exe PID: 7272	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.thelper.exe.31c0000.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
8.2.thelper.exe.31c0000.6.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
8.2.thelper.exe.31c0000.6.unpack	MALWARE_Win_FatalRAT	Detects FatalRAT	ditekSHen	0x20c46:$x1: XXAcQbcXXfRSScR 0x20a70:$s1: CHROME_NO_DATA 0x20a80:$s1: CHROME_NO_DATA 0x20a90:$s1: CHROME_NO_DATA 0x20aa0:$s2: CHROME_UNKNOW 0x20ab0:$s2: CHROME_UNKNOW 0x20ac0:$s2: CHROME_UNKNOW 0x20ad0:$s2: CHROME_UNKNOW 0x20ae0:$s2: CHROME_UNKNOW 0x20af0:$s2: CHROME_UNKNOW 0x20b00:$s2: CHROME_UNKNOW 0x20b10:$s2: CHROME_UNKNOW 0x20b20:$s2: CHROME_UNKNOW 0x20d68:$s3: -Thread running... 0x21c2c:$s4: InetCpl.cpl,ClearMyTracksByProcess 0x20b8e:$s5: MSAcpi_ThermalZoneTemperature 0x20cf0:$s6: taskkill /f /im rundll32.exe 0x21cf0:$s7: del /s /f %appdata%\Mozilla\Firefox 0x222a4:$s8: \\%s\C$\ 0x20a44:$s9: fnGetChromeUserInfo 0x20e1c:$s10: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
9.2.thelper.exe.2cc0000.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
9.2.thelper.exe.2cc0000.6.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
9.2.thelper.exe.2cc0000.6.unpack	MALWARE_Win_FatalRAT	Detects FatalRAT	ditekSHen	0x20c46:$x1: XXAcQbcXXfRSScR 0x20a70:$s1: CHROME_NO_DATA 0x20a80:$s1: CHROME_NO_DATA 0x20a90:$s1: CHROME_NO_DATA 0x20aa0:$s2: CHROME_UNKNOW 0x20ab0:$s2: CHROME_UNKNOW 0x20ac0:$s2: CHROME_UNKNOW 0x20ad0:$s2: CHROME_UNKNOW 0x20ae0:$s2: CHROME_UNKNOW 0x20af0:$s2: CHROME_UNKNOW 0x20b00:$s2: CHROME_UNKNOW 0x20b10:$s2: CHROME_UNKNOW 0x20b20:$s2: CHROME_UNKNOW 0x20d68:$s3: -Thread running... 0x21c2c:$s4: InetCpl.cpl,ClearMyTracksByProcess 0x20b8e:$s5: MSAcpi_ThermalZoneTemperature 0x20cf0:$s6: taskkill /f /im rundll32.exe 0x21cf0:$s7: del /s /f %appdata%\Mozilla\Firefox 0x222a4:$s8: \\%s\C$\ 0x20a44:$s9: fnGetChromeUserInfo 0x20e1c:$s10: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
7.2.thelper.exe.1130000.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
7.2.thelper.exe.1130000.6.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
7.2.thelper.exe.1130000.6.unpack	MALWARE_Win_FatalRAT	Detects FatalRAT	ditekSHen	0x20c46:$x1: XXAcQbcXXfRSScR 0x20a70:$s1: CHROME_NO_DATA 0x20a80:$s1: CHROME_NO_DATA 0x20a90:$s1: CHROME_NO_DATA 0x20aa0:$s2: CHROME_UNKNOW 0x20ab0:$s2: CHROME_UNKNOW 0x20ac0:$s2: CHROME_UNKNOW 0x20ad0:$s2: CHROME_UNKNOW 0x20ae0:$s2: CHROME_UNKNOW 0x20af0:$s2: CHROME_UNKNOW 0x20b00:$s2: CHROME_UNKNOW 0x20b10:$s2: CHROME_UNKNOW 0x20b20:$s2: CHROME_UNKNOW 0x20d68:$s3: -Thread running... 0x21c2c:$s4: InetCpl.cpl,ClearMyTracksByProcess 0x20b8e:$s5: MSAcpi_ThermalZoneTemperature 0x20cf0:$s6: taskkill /f /im rundll32.exe 0x21cf0:$s7: del /s /f %appdata%\Mozilla\Firefox 0x222a4:$s8: \\%s\C$\ 0x20a44:$s9: fnGetChromeUserInfo 0x20e1c:$s10: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 54.224.49.0, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 2896, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Snort Signatures

ETPRO MALWARE TakeMyFile User-Agent - Source IP: 192.168.2.4 - Destination IP: 54.224.49.0

Timestamp:	07/17/24-17:10:19.103117
SID:	2849814
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE TakeMyFile Installer Checkin - Source IP: 192.168.2.4 - Destination IP: 54.224.49.0

Timestamp:	07/17/24-17:10:19.103117
SID:	2849813
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Suricata Signatures

ETPRO HUNTING Request for config.json - Source IP: 192.168.2.4 - Destination IP: 184.28.90.27

Timestamp:	2024-07-17T17:10:24.358485+0200
SID:	2840787
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.4 - Destination IP: 54.224.49.0

Timestamp:	2024-07-17T17:10:19.276636+0200
SID:	2849814
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile Installer Checkin - Source IP: 192.168.2.4 - Destination IP: 54.224.49.0

Timestamp:	2024-07-17T17:10:19.276636+0200
SID:	2849813
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO HUNTING Windows System Information in UA - Source IP: 192.168.2.4 - Destination IP: 54.224.49.0

Timestamp:	2024-07-17T17:10:19.276636+0200
SID:	2848122
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Misc activity

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FatalRAT

Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.2% probability

Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_d563f2eb-3

Source: C:\ProgramData\Microsoft\MF\thelper.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\Administrator\source\repos\Dll2\Debug\Dll2.pdb source: thelper.exe, 00000007.00000002.1798443711.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000008.00000002.1794970185.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000009.00000002.1787878704.000000006C19E000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Dll6\Debug\Dll6.pdb source: thelper.exe, 00000007.00000002.1801136745.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, thelper.exe, 00000008.00000002.1796688584.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, thelper.exe, 00000009.00000002.1796619824.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, mt.dll.1.dr
Source:	Binary string: wininet.pdb source: shi5E8D.tmp.2.dr
Source:	Binary string: msvcr90.i386.pdb source: msvcr90.dll.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLLuaRuntime\XLLuaRuntime.pdb source: thelper.exe, 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmp, thelper.exe, 00000008.00000002.1788918364.0000000010031000.00000002.00000001.01000000.0000000C.sdmp, thelper.exe, 00000009.00000002.1782523120.0000000000F01000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSI704E.tmp, 00000004.00000000.1763370399.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI704E.tmp, 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI706F.tmp, 00000005.00000000.1764144098.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, MSI706F.tmp, 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr
Source:	Binary string: atl90.i386.pdb source: thelper.exe, 00000007.00000002.1801688962.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, thelper.exe, 00000008.00000002.1797050469.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, thelper.exe, 00000009.00000002.1797063230.000000006C981000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLUE\XLUE.pdb\| source: thelper.exe, 00000007.00000002.1795613339.00000000101B8000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000008.00000002.1786695817.0000000001568000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000009.00000002.1785152260.00000000101B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: d3d12.pdbUGP source: shi5FD6.tmp.2.dr
Source:	Binary string: E:\project\svn_3rd_source\sqlite-amalgamation-3071100\sqlitedll\Release\sqlite3.pdb source: sqlite3.dll.1.dr
Source:	Binary string: E:\project\svn_3rd_source\sqlite-amalgamation-3071100\sqlitedll\Release\sqlite3.pdbQh source: sqlite3.dll.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbH' source: thelper.exe, 00000009.00000002.1783012666.0000000001253000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbz source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI5C5C.tmp.1.dr, 5559f9.msi.1.dr, MSI5D0A.tmp.1.dr
Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\ex_data.c source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: e:\Work\Thunder\xl8_client\thunder\src\BrowserSupport\pdb\ProductRelease\BrowserSupport.pdb source: thelper.exe, 00000007.00000000.1768993886.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000007.00000003.1774208611.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000002.1785928209.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000000.1770305223.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000002.1782793760.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000000.1771983142.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 0000000C.00000000.1780060388.000000000086F000.00000002.00000001.01000000.00000013.sdmp, thelper.exe.1.dr
Source:	Binary string: C:\Users\Administrator\source\repos\Dll2\Debug\Dll2.pdb( source: thelper.exe, 00000007.00000002.1798443711.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000008.00000002.1794970185.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000009.00000002.1787878704.000000006C19E000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLFSIO\XLFSIO.pdb source: thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI6CD3.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI6BB7.tmp.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLUE\XLUE.pdb source: thelper.exe, 00000007.00000002.1795613339.00000000101B8000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000008.00000002.1786695817.0000000001568000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000009.00000002.1785152260.00000000101B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Dll1\KSMDYH-DLL\Dll1.pdb source: thelper.exe, 00000007.00000002.1799731429.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp, thelper.exe, 00000008.00000002.1796020662.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp, thelper.exe, 00000009.00000002.1795835586.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbHn source: thelper.exe, 00000008.00000002.1787044398.00000000016C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbH source: thelper.exe, 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: e:\project\svn_3rd_source\XML\bin\libexpat.pdb source: thelper.exe, 00000007.00000002.1796864841.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000008.00000002.1789246295.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000009.00000002.1786563464.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, libexpat.dll.1.dr
Source:	Binary string: d3d12.pdb source: shi5FD6.tmp.2.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdb source: thelper.exe, 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmp, thelper.exe, 00000008.00000002.1787044398.00000000016C3000.00000002.00000001.01000000.0000000D.sdmp, thelper.exe, 00000009.00000002.1783012666.0000000001253000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wininet.pdbUGP source: shi5E8D.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: e:\project\svn_3rd_source\XML\bin\libexpat.pdblA source: thelper.exe, 00000007.00000002.1796864841.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000008.00000002.1789246295.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000009.00000002.1786563464.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, libexpat.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI5C5C.tmp.1.dr, 5559f9.msi.1.dr, MSI5D0A.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSI704E.tmp, 00000004.00000000.1763370399.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI704E.tmp, 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI706F.tmp, 00000005.00000000.1764144098.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, MSI706F.tmp, 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr
Source:	Binary string: H:\rc_v11_personal_20221122_branch\Build\Release\WPSOffice\office6\addons\konlinesetup\konlinesetup.pdb source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A6B02D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00A6B02D
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001AB02D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_001AB02D
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F89398 PathFileExistsW,FindFirstFileW,FindClose,	7_2_00F89398
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F97450 __EH_prolog3_GS,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z,??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z,FindFirstFileW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,FindNextFileW,FindClose,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,FindClose,	7_2_00F97450
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F89407 GetFileAttributesExW,FindFirstFileW,FindClose,CreateFileW,GetFileSizeEx,CloseHandle,	7_2_00F89407
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F9766D __EH_prolog3,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z,??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z,memset,_swprintf,_swprintf,FindFirstFileW,DeleteFileW,_wcsicmp,_wcsicmp,memset,_swprintf,RemoveDirectoryW,_wcsicmp,memset,_swprintf,_swprintf,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,	7_2_00F9766D

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2849814 ETPRO MALWARE TakeMyFile User-Agent 192.168.2.4:49733 -> 54.224.49.0:80
Source: Traffic	Snort IDS: 2849813 ETPRO MALWARE TakeMyFile Installer Checkin 192.168.2.4:49733 -> 54.224.49.0:80

Source: global traffic	HTTP traffic detected: POST /api/v1/link HTTP/1.1Host: downloader.wps.cnAccept: /Client-Type: loader-pcClient-Chan: 10.1.xxxxClient-Ver: 1.0.0Client-Lang: zhContent-Type: application/jsonAuthorization: WPS:yqW282sr:YzhiYWY3ZjA1NWE5MGNmOWY2YzUyYjgzNjMyMjczNDUyMmQ5ZjMwZA==Date: Wed, 17 Jul 2024 16:40:47 GMTContent-Md5: ZmUyMDdjYmZiOTFiZmIyMjQxOGZhNWNhZjU1ODgxZGY=Content-Length: 151
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 185Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/jsondw-protocol: 1.0Content-Length: 889Host: shuc-pc-snow.ksord.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com
Source: global traffic	HTTP traffic detected: POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 120Host: dw-online.ksosoft.com

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00F9B852 recv,WSAGetLastError,?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z,IsBadCodePtr,?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z,

7_2_00F9B852

Source: global traffic	DNS traffic detected: DNS query: collect.installeranalytics.com
Source: global traffic	DNS traffic detected: DNS query: dw-online.ksosoft.com
Source: global traffic	DNS traffic detected: DNS query: shuc-pc-snow.ksord.com
Source: global traffic	DNS traffic detected: DNS query: downloader.wps.cn

Source: unknown

HTTP traffic detected: POST /api/v1/link HTTP/1.1Host: downloader.wps.cnAccept: */*Client-Type: loader-pcClient-Chan: 10.1.xxxxClient-Ver: 1.0.0Client-Lang: zhContent-Type: application/jsonAuthorization: WPS:yqW282sr:YzhiYWY3ZjA1NWE5MGNmOWY2YzUyYjgzNjMyMjczNDUyMmQ5ZjMwZA==Date: Wed, 17 Jul 2024 16:40:47 GMTContent-Md5: ZmUyMDdjYmZiOTFiZmIyMjQxOGZhNWNhZjU1ODgxZGY=Content-Length: 151

Source: shi5E8D.tmp.2.dr	String found in binary or memory: http://.css
Source: shi5E8D.tmp.2.dr	String found in binary or memory: http://.jpg
Source: thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://SVP7.NET:9874/AnyDesk.exe
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://dw-collect-debug.ksord.com)
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com
Source: WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/Ut
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v1/app/dynamicUrldnsParseIpserverTimegzipSizesplitSize
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/2.8.16dcsdk_eventv3.dbdcsdk_dpv3.datadcsdk_cfg.
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000441C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686
Source: WPS.exe, 0000000D.00000003.1833564279.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1833908101.0000000004441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686$)DR
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686%
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686.
Source: WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686/
Source: WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36860
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36863
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36868
Source: WPS.exe, 0000000D.00000003.1833872908.000000000441F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686:
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686F
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686O
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686P
Source: WPS.exe, 0000000D.00000003.1913366269.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914405477.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Q
Source: WPS.exe, 0000000D.00000003.1833872908.000000000441F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686U
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Y
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686c
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686i
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686t
Source: WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686u
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686z
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686~
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com/api/dynamicParam/v3/app/TEM32
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c3686
Source: WPS.exe, 0000000D.00000003.1826993237.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881962006.0000000004411000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c368612.2019
Source: WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c3686b
Source: WPS.exe, 00000006.00000003.1783487971.0000000001368000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783467220.0000000001361000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785170879.0000000001369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dw-online.ksosoft.compDa
Source: WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://event.4wps.net
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://event.4wps.nethttps://event.wps.comtELAPSE_UPDATE_DYNAMIC_PARAM_MINELAPSE_UPDATE_DYNAMIC_PARA
Source: shi5E8D.tmp.2.dr	String found in binary or memory: http://html4/loose.dtd
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, WPS.exe.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, WPS.exe.1.dr, 5559f9.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://s.symcd.com06
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: WPS.exe, 0000000D.00000003.1833756944.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000444F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000444A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827440740.000000000444E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ks
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com
Source: WPS.exe, 0000000D.00000003.1809492594.0000000004469000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2962702524.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)
Source: WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)7
Source: WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com);B
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)Ct
Source: WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)EB
Source: WPS.exe, 0000000D.00000003.1809611089.000000000444E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)e
Source: WPS.exe, 0000000D.00000003.1881718056.0000000004455000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000444E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)q
Source: WPS.exe, 0000000D.00000003.1833756944.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827656785.0000000004453000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827440740.000000000444E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com)t
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com/
Source: WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com/NB
Source: WPS.exe, 0000000D.00000003.1881330582.000000000443C000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1833564279.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000443B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.com:80/=
Source: WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shuc-pc-snow.ksord.comot
Source: thelper.exe	String found in binary or memory: http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1
Source: thelper.exe, 00000007.00000000.1768993886.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000007.00000003.1774208611.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000002.1785928209.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000000.1770305223.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000002.1782793760.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000000.1771983142.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 0000000C.00000000.1780060388.000000000086F000.00000002.00000001.01000000.00000013.sdmp, thelper.exe.1.dr	String found in binary or memory: http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1instdirSOFTWARE
Source: thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://svp7.net:9874/UltraViewer.exe
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784375869.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784186465.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784463304.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784540865.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll-DeleteNoRemoveForceRemoveValBDMS
Source: thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll1.2.3
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wps.cn/privacy/privacyprotect2
Source: WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: WPS.exe, 00000006.00000003.1770673509.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770770886.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770958115.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770721164.0000000001393000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770911106.0000000001399000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1770837654.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784303099.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784093714.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784125821.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784349858.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784155851.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1784256439.0000000000E01000.00000004.00000020.00020000.00000000.sdmp, WPS.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://downloader.wps.cn/api/v1/link
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://downloader.wps.cn/api/v1/link/api/v1/linkloader-pc10.1.xxxx1.0.0zhapplication/json%02xWPS:%s
Source: WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://event.wps.com
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://event.wps.comr
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://get.wps.cn/feedback/pc
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://get.wps.cn/feedback/pchttps://official-package.wpscdn.cn/wps/download/WPS_Setup.exe1test
Source: WPS.exe, 0000000D.00000003.1913366269.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000446B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1915053692.000000000444A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914405477.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000444F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://official-package.wpscdn.cn/wps/download/WPS_Setup_15319.exe
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wps.cn/privacy/useragreement

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

E-Banking Fraud

Yara detected FatalRAT

Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects FatalRAT Author: ditekSHen
Source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects FatalRAT Author: ditekSHen
Source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE	Matched rule: Detects FatalRAT Author: ditekSHen

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5559f9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BCE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C5C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C7C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D0A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D97.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6950.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6990.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6A9A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6ABB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6B0A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BB7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BB8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C74.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CD3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI704E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI706F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70BE.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI5BCE.tmp

Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A36A50	4_2_00A36A50
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A6F032	4_2_00A6F032
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A692A9	4_2_00A692A9
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5C2CA	4_2_00A5C2CA
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5E270	4_2_00A5E270
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A684BD	4_2_00A684BD
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5A587	4_2_00A5A587
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A3C870	4_2_00A3C870
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A54920	4_2_00A54920
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5A915	4_2_00A5A915
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A60A48	4_2_00A60A48
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A39CC0	4_2_00A39CC0
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A65D6D	4_2_00A65D6D
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_00176A50	5_2_00176A50
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001AF032	5_2_001AF032
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019E270	5_2_0019E270
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001A92A9	5_2_001A92A9
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019C2CA	5_2_0019C2CA
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001A84BD	5_2_001A84BD
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019A587	5_2_0019A587
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0017C870	5_2_0017C870
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019A915	5_2_0019A915
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_00194920	5_2_00194920
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001A0A48	5_2_001A0A48
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_00179CC0	5_2_00179CC0
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001A5D6D	5_2_001A5D6D
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E740F0	7_2_00E740F0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E42000	7_2_00E42000
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EA6190	7_2_00EA6190
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E60160	7_2_00E60160
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E44280	7_2_00E44280
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E9E3E0	7_2_00E9E3E0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E44363	7_2_00E44363
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E5A340	7_2_00E5A340
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E6C330	7_2_00E6C330
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E56470	7_2_00E56470
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E765F0	7_2_00E765F0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E446B8	7_2_00E446B8
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E5E760	7_2_00E5E760
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EB4730	7_2_00EB4730
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EA49A0	7_2_00EA49A0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EC4960	7_2_00EC4960
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E6E970	7_2_00E6E970
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E56A40	7_2_00E56A40
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E58A30	7_2_00E58A30
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EB4B30	7_2_00EB4B30
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E5ACA0	7_2_00E5ACA0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E8CC70	7_2_00E8CC70
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E48C50	7_2_00E48C50
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E44C30	7_2_00E44C30
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E90C30	7_2_00E90C30
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E76C10	7_2_00E76C10
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E74DA0	7_2_00E74DA0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E5CE20	7_2_00E5CE20
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4AE0B	7_2_00E4AE0B
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E47090	7_2_00E47090
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E57020	7_2_00E57020
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E61140	7_2_00E61140
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4B3CA	7_2_00E4B3CA
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E45450	7_2_00E45450
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E636C0	7_2_00E636C0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E8B6A0	7_2_00E8B6A0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E5B600	7_2_00E5B600
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E75760	7_2_00E75760
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E879D0	7_2_00E879D0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EC39A0	7_2_00EC39A0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EA5910	7_2_00EA5910
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E41AF0	7_2_00E41AF0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E43A00	7_2_00E43A00
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E63B28	7_2_00E63B28
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E41C40	7_2_00E41C40
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E93DD0	7_2_00E93DD0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E75ED0	7_2_00E75ED0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E41E50	7_2_00E41E50
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F81A70	7_2_00F81A70
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F94A80	7_2_00F94A80
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F951FE	7_2_00F951FE
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F955A1	7_2_00F955A1
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F93FFB	7_2_00F93FFB
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00FEC143	7_2_00FEC143
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00FEC2FA	7_2_00FEC2FA
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00FEC3E3	7_2_00FEC3E3
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00FEC4AF	7_2_00FEC4AF

Source: C:\Windows\Installer\MSI704E.tmp	Code function: String function: 00A5325F appears 103 times
Source: C:\Windows\Installer\MSI704E.tmp	Code function: String function: 00A53292 appears 66 times
Source: C:\Windows\Installer\MSI704E.tmp	Code function: String function: 00A53790 appears 39 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00F8E734 appears 80 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00FD65B0 appears 31 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00F8E79D appears 107 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00ECF250 appears 32 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00FE2BC0 appears 39 times
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: String function: 00ECF1A0 appears 51 times
Source: C:\Windows\Installer\MSI706F.tmp	Code function: String function: 0019325F appears 103 times
Source: C:\Windows\Installer\MSI706F.tmp	Code function: String function: 00193790 appears 39 times
Source: C:\Windows\Installer\MSI706F.tmp	Code function: String function: 00193292 appears 66 times

Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameviewer.exeF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameaischeduler.dllF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameInstallerAnalytics.dllF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

Source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_FatalRAT author = ditekSHen, description = Detects FatalRAT
Source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_FatalRAT author = ditekSHen, description = Detects FatalRAT
Source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_FatalRAT author = ditekSHen, description = Detects FatalRAT

Source: shi5E8D.tmp.2.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: mal100.troj.evad.winMSI@17/62@4/4

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00F970CA __ehhandler$___std_fs_get_file_id@8,__EH_prolog3_GS,GetDiskFreeSpaceExW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,

7_2_00F970CA

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A33860 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

4_2_00A33860

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A34BA0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

4_2_00A34BA0

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A345B0 LoadResource,LockResource,SizeofResource,

4_2_00A345B0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\v76.23.66

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\WPS.exe

Jump to behavior

Source: C:\ProgramData\Microsoft\MF\thelper.exe	Mutant created: \Sessions\1\BaseNamedObjects\xl8.browserSupport.mutexId
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\KOnlinesetupOnlineStoreMutexNew_EF472A88-E1D0-44DF-B44E-FF5186E43ADC
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7B585BD5-8E73-4058-B7DF-F46EE9AB43BC}KDCSDK_RESTORE_LOCK_MUTEXc61d70264a276dce577f59ab220eb5d6
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7B585BD5-8E73-4058-B7DF-F46EE9AB43BC}KDCSDK_SEND_DEVICE_INFO_MUTEX
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\KdcDBGlobalMutexC:_Users_user_AppData_Roaming_kingsoft_wps_dcsdk_dcsdk_eventv3.db
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\_KHDIDMGR_3E67DFEF-DF4E-4CC6-9413-5F71C7C96C04
Source: C:\Users\user\AppData\Roaming\WPS.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7B585BD5-8E73-4058-B7DF-F46EE9AB43BC}other1721229014106_7412

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF53F1EB06D587FA2C.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM groups limit 60;CASE
Source: sqlite3.dll.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sqlite3.dll.1.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM groups limit 60;NARY
Source: sqlite3.dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM groups limit 60;
Source: sqlite3.dll.1.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3.dll.1.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM groups limit 60;RIM
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.1.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.1.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding AF7A5A98FCE59EB21923DEC3642535A5
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FC7440F48901E81826ED2A23961C7067 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI704E.tmp "C:\Windows\Installer\MSI704E.tmp" /DontWait "C:\Users\user\AppData\Roaming\WPS.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI706F.tmp "C:\Windows\Installer\MSI706F.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\WPS.exe "C:\Users\user\AppData\Roaming\WPS.exe"
Source: unknown	Process created: C:\ProgramData\Microsoft\MF\thelper.exe "C:\ProgramData\Microsoft\MF\thelper.exe"
Source: unknown	Process created: C:\ProgramData\Microsoft\MF\thelper.exe C:\ProgramData\Microsoft\MF\thelper.exe
Source: unknown	Process created: C:\ProgramData\Microsoft\MF\thelper.exe C:\ProgramData\Microsoft\MF\thelper.exe
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process created: C:\Users\user\AppData\Local\thelper.exe "C:\Users\user\AppData\Local\thelper.exe"
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process created: C:\Users\user\AppData\Roaming\WPS.exe "C:\Users\user\AppData\Roaming\WPS.exe" -upgradepower
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding AF7A5A98FCE59EB21923DEC3642535A5	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FC7440F48901E81826ED2A23961C7067 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI704E.tmp "C:\Windows\Installer\MSI704E.tmp" /DontWait "C:\Users\user\AppData\Roaming\WPS.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI706F.tmp "C:\Windows\Installer\MSI706F.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process created: C:\Users\user\AppData\Local\thelper.exe "C:\Users\user\AppData\Local\thelper.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\Installer\MSI704E.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI704E.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI704E.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI704E.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI704E.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI706F.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI706F.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI706F.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI706F.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI706F.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlue.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlluaruntime.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlluaruntime.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libexpat.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libpng13.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: ic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlue.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlluaruntime.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libexpat.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libpng13.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: ic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlue.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlluaruntime.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlgraphic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlluaruntime.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libexpat.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: libpng13.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: xlfsio2.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mt.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: ic.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\tracking.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

Static file information: File size 9958912 > 1048576

Source: C:\ProgramData\Microsoft\MF\thelper.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\Administrator\source\repos\Dll2\Debug\Dll2.pdb source: thelper.exe, 00000007.00000002.1798443711.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000008.00000002.1794970185.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000009.00000002.1787878704.000000006C19E000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Dll6\Debug\Dll6.pdb source: thelper.exe, 00000007.00000002.1801136745.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, thelper.exe, 00000008.00000002.1796688584.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, thelper.exe, 00000009.00000002.1796619824.000000006C51F000.00000002.00000001.01000000.00000011.sdmp, mt.dll.1.dr
Source:	Binary string: wininet.pdb source: shi5E8D.tmp.2.dr
Source:	Binary string: msvcr90.i386.pdb source: msvcr90.dll.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLLuaRuntime\XLLuaRuntime.pdb source: thelper.exe, 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmp, thelper.exe, 00000008.00000002.1788918364.0000000010031000.00000002.00000001.01000000.0000000C.sdmp, thelper.exe, 00000009.00000002.1782523120.0000000000F01000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSI704E.tmp, 00000004.00000000.1763370399.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI704E.tmp, 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI706F.tmp, 00000005.00000000.1764144098.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, MSI706F.tmp, 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr
Source:	Binary string: atl90.i386.pdb source: thelper.exe, 00000007.00000002.1801688962.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, thelper.exe, 00000008.00000002.1797050469.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, thelper.exe, 00000009.00000002.1797063230.000000006C981000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLUE\XLUE.pdb\| source: thelper.exe, 00000007.00000002.1795613339.00000000101B8000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000008.00000002.1786695817.0000000001568000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000009.00000002.1785152260.00000000101B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: d3d12.pdbUGP source: shi5FD6.tmp.2.dr
Source:	Binary string: E:\project\svn_3rd_source\sqlite-amalgamation-3071100\sqlitedll\Release\sqlite3.pdb source: sqlite3.dll.1.dr
Source:	Binary string: E:\project\svn_3rd_source\sqlite-amalgamation-3071100\sqlitedll\Release\sqlite3.pdbQh source: sqlite3.dll.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbH' source: thelper.exe, 00000009.00000002.1783012666.0000000001253000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbz source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI5C5C.tmp.1.dr, 5559f9.msi.1.dr, MSI5D0A.tmp.1.dr
Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\ex_data.c source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: e:\Work\Thunder\xl8_client\thunder\src\BrowserSupport\pdb\ProductRelease\BrowserSupport.pdb source: thelper.exe, 00000007.00000000.1768993886.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000007.00000003.1774208611.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000002.1785928209.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000000.1770305223.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000002.1782793760.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000000.1771983142.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 0000000C.00000000.1780060388.000000000086F000.00000002.00000001.01000000.00000013.sdmp, thelper.exe.1.dr
Source:	Binary string: C:\Users\Administrator\source\repos\Dll2\Debug\Dll2.pdb( source: thelper.exe, 00000007.00000002.1798443711.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000008.00000002.1794970185.000000006C19E000.00000002.00000001.01000000.00000012.sdmp, thelper.exe, 00000009.00000002.1787878704.000000006C19E000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLFSIO\XLFSIO.pdb source: thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI6CD3.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI6BB7.tmp.1.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLUE\XLUE.pdb source: thelper.exe, 00000007.00000002.1795613339.00000000101B8000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000008.00000002.1786695817.0000000001568000.00000002.00000001.01000000.00000008.sdmp, thelper.exe, 00000009.00000002.1785152260.00000000101B8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Dll1\KSMDYH-DLL\Dll1.pdb source: thelper.exe, 00000007.00000002.1799731429.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp, thelper.exe, 00000008.00000002.1796020662.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp, thelper.exe, 00000009.00000002.1795835586.000000006C2BF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbHn source: thelper.exe, 00000008.00000002.1787044398.00000000016C3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdbH source: thelper.exe, 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: e:\project\svn_3rd_source\XML\bin\libexpat.pdb source: thelper.exe, 00000007.00000002.1796864841.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000008.00000002.1789246295.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000009.00000002.1786563464.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, libexpat.dll.1.dr
Source:	Binary string: d3d12.pdb source: shi5FD6.tmp.2.dr
Source:	Binary string: e:\work\xunlei_uiengine\pdb\ProductRelease\XLGraphic\XLGraphic.pdb source: thelper.exe, 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmp, thelper.exe, 00000008.00000002.1787044398.00000000016C3000.00000002.00000001.01000000.0000000D.sdmp, thelper.exe, 00000009.00000002.1783012666.0000000001253000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wininet.pdbUGP source: shi5E8D.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr
Source:	Binary string: e:\project\svn_3rd_source\XML\bin\libexpat.pdblA source: thelper.exe, 00000007.00000002.1796864841.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000008.00000002.1789246295.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, thelper.exe, 00000009.00000002.1786563464.0000000021D5D000.00000002.00000001.01000000.0000000B.sdmp, libexpat.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI5C5C.tmp.1.dr, 5559f9.msi.1.dr, MSI5D0A.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSI704E.tmp, 00000004.00000000.1763370399.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI704E.tmp, 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmp, MSI706F.tmp, 00000005.00000000.1764144098.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, MSI706F.tmp, 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmp, WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr
Source:	Binary string: H:\rc_v11_personal_20221122_branch\Build\Release\WPSOffice\office6\addons\konlinesetup\konlinesetup.pdb source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -FS -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp

Source: shi5FD6.tmp.2.dr

Static PE information: 0x96D7AA59 [Sat Mar 12 16:44:09 2050 UTC]

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00F869A0 luaL_checkudata,luaL_checknumber,LoadLibraryW,GetProcAddress,

7_2_00F869A0

Source: XLFSIO.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0xec728
Source: MSI6B0A.tmp.1.dr	Static PE information: real checksum: 0xceae6 should be: 0xcc7bd
Source: MSI6950.tmp.1.dr	Static PE information: real checksum: 0xceae6 should be: 0xcc7bd
Source: ic.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x1a1418
Source: MSI6990.tmp.1.dr	Static PE information: real checksum: 0xceae6 should be: 0xcc7bd
Source: thelper.exe.1.dr	Static PE information: real checksum: 0x3e346 should be: 0x3b000
Source: MSI70BE.tmp.1.dr	Static PE information: real checksum: 0xceae6 should be: 0xcc7bd
Source: mt.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x189f70
Source: MSI5BCE.tmp.1.dr	Static PE information: real checksum: 0xceae6 should be: 0xcc7bd
Source: thelper.exe.7.dr	Static PE information: real checksum: 0x3e346 should be: 0x3b000

Source: libexpat.dll.1.dr	Static PE information: section name: .textbss
Source: mt.dll.1.dr	Static PE information: section name: .textbss
Source: mt.dll.1.dr	Static PE information: section name: .msvcjmc
Source: mt.dll.1.dr	Static PE information: section name: .00cfg
Source: XLFSIO.dll.1.dr	Static PE information: section name: .00cfg
Source: XLFSIO2.dll.1.dr	Static PE information: section name: .uestat
Source: XLGraphic.dll.1.dr	Static PE information: section name: .uestat
Source: XLLuaRuntime.dll.1.dr	Static PE information: section name: .uestat
Source: XLUE.dll.1.dr	Static PE information: section name: .uestat
Source: XLUE.dll.1.dr	Static PE information: section name: .uestr
Source: ic.dll.1.dr	Static PE information: section name: .textbss
Source: ic.dll.1.dr	Static PE information: section name: .msvcjmc
Source: ic.dll.1.dr	Static PE information: section name: .00cfg
Source: shi5E8D.tmp.2.dr	Static PE information: section name: .wpp_sf
Source: shi5E8D.tmp.2.dr	Static PE information: section name: .didat

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5323C push ecx; ret	4_2_00A5324F
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019323C push ecx; ret	5_2_0019324F
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00ED1079 push ecx; ret	7_2_00ED108C
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F8E7D3 push ecx; ret	7_2_00F8E7E6
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F8E931 push ecx; ret	7_2_00F8E944

Source: msvcr90.dll.1.dr

Static PE information: section name: .text entropy: 6.92063892456726

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI706F.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI704E.tmp			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI704E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C5C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\libpng13.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLGraphic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6ABB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\thelper.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLUE.dll	Jump to dropped file
Source: C:\ProgramData\Microsoft\MF\thelper.exe	File created: C:\Users\user\AppData\Local\thelper.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70BE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLFSIO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BB8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BCE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D97.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\WPS.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C7C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6990.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\libexpat.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\mt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C74.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D0A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6A9A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6950.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi5E8D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\atl90.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi5FD6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI706F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\ic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6B0A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLFSIO2.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\libpng13.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\libexpat.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLGraphic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\mt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\thelper.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLUE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\atl90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLFSIO.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\ic.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\MF\XLFSIO2.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI704E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BCE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D97.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C5C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C7C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6990.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6ABB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C74.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D0A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6950.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6A9A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70BE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI706F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6B0A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BB8.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\WPS.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\WPS.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00ECFF40 rdtsc

7_2_00ECFF40

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5D97.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5BCE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5C5C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5C7C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6990.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6ABB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6C74.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5D0A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\MF\msvcp90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6A9A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6950.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi5E8D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\MF\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\MF\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\MF\atl90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI70BE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi5FD6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6CD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6BB8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6B0A.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSI706F.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_5-32958
Source: C:\Windows\Installer\MSI704E.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_4-32798

Source: C:\Windows\Installer\MSI704E.tmp	API coverage: 6.3 %
Source: C:\Windows\Installer\MSI706F.tmp	API coverage: 6.6 %
Source: C:\ProgramData\Microsoft\MF\thelper.exe	API coverage: 2.7 %

Source: C:\Users\user\AppData\Roaming\WPS.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A6B02D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00A6B02D
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001AB02D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_001AB02D
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F89398 PathFileExistsW,FindFirstFileW,FindClose,	7_2_00F89398
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F97450 __EH_prolog3_GS,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z,??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z,FindFirstFileW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,FindNextFileW,FindClose,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,FindClose,	7_2_00F97450
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F89407 GetFileAttributesExW,FindFirstFileW,FindClose,CreateFileW,GetFileSizeEx,CloseHandle,	7_2_00F89407
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F9766D __EH_prolog3,??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z,??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z,??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z,memset,_swprintf,_swprintf,FindFirstFileW,DeleteFileW,_wcsicmp,_wcsicmp,memset,_swprintf,RemoveDirectoryW,_wcsicmp,memset,_swprintf,_swprintf,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ,	7_2_00F9766D

Source: WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: =sRADVAPI32.dllAcquireSRWLockExclusiveReleaseSRWLockExclusiveROOT\CIMV2SELECT * FROM Win32_DiskDriveWQLSerialNumberModelFirmwareRevision\\.\PhysicalDrive%dIphlpapi.dllGetAdaptersInfoSYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}CharacteristicsComponentIdPCIXENNetCfgInstanceId%02X-%02X-%02X-%02X-%02X-%02X\|_KHDIDMGR_3E67DFEF-DF4E-4CC6-9413-5F71C7C96C04InfoHDtInfoHD\|
Source: 5559f9.msi.1.dr	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: thelper.exe, 00000007.00000002.1784973615.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XXAcQbcXXfRSScRKernel32.dllCreateToolhelp32SnapshotKernel32.dllCreateToolhelp32SnapshotHARDWARE\DESCRIPTION\System\BIOS\SystemManufacturerVMWAREtaskkill /f /im rundll32.exeDisableLockWorkstationSoftware\Microsoft\Windows\CurrentVersion\Policies\SystemSVP7-Thread running...
Source: thelper.exe, 00000007.00000002.1784973615.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: thelper.exe, 00000007.00000002.1784973615.0000000000A5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y[
Source: WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914796126.0000000004413000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1915053692.0000000004414000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881962006.0000000004415000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .PADbad bufferbad AllocateROOT\WMISELECT * FROM MSAcpi_ThermalZoneTemperatureWQLCurrentTemperature\\.\PhysicalDrive0VMware ToolsVMware
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Tools
Source: WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914796126.0000000004413000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1915053692.0000000004414000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881962006.0000000004415000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: thelper.exe, 00000008.00000002.1786046067.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%%

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_7-71612

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00ECFF40 rdtsc

7_2_00ECFF40

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A3D0A5 IsDebuggerPresent,OutputDebugStringW,

4_2_00A3D0A5

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00F869A0 luaL_checkudata,luaL_checknumber,LoadLibraryW,GetProcAddress,

7_2_00F869A0

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A62DCC mov ecx, dword ptr fs:[00000030h]	4_2_00A62DCC
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A6AD78 mov eax, dword ptr fs:[00000030h]	4_2_00A6AD78
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001AAD78 mov eax, dword ptr fs:[00000030h]	5_2_001AAD78
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001A2DCC mov ecx, dword ptr fs:[00000030h]	5_2_001A2DCC

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A32310 GetProcessHeap,

4_2_00A32310

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI704E.tmp "C:\Windows\Installer\MSI704E.tmp" /DontWait "C:\Users\user\AppData\Roaming\WPS.exe"

Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A533A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00A533A8
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A5353F SetUnhandledExceptionFilter,	4_2_00A5353F
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A52968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00A52968
Source: C:\Windows\Installer\MSI704E.tmp	Code function: 4_2_00A56E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00A56E1B
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_001933A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_001933A8
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_0019353F SetUnhandledExceptionFilter,	5_2_0019353F
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_00192968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00192968
Source: C:\Windows\Installer\MSI706F.tmp	Code function: 5_2_00196E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00196E1B
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00ED068E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_00ED068E
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F8E222 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_00F8E222
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00F8EACA SetUnhandledExceptionFilter,	7_2_00F8EACA

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A352F0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

4_2_00A352F0

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Process created: C:\Users\user\AppData\Local\thelper.exe "C:\Users\user\AppData\Local\thelper.exe"

Jump to behavior

Source: thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progman
Source: thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .lnk1200.exerun.exe\1234UltraViewerhttp://svp7.net:9874/UltraViewer.exe\UltraViewer.exeuv_x64.exeUI0Detect.exeUltraViewer_Service.exeUltraViewer_Desktop.exeunins000.exeUltraViewer UninstallButtonUltraViewer UninstallButtoniexplore.exeuvh.dlliexplore.exeAnyDesk.exe\http://SVP7.NET:9874/AnyDesk.exe\AnyDesk.exe\\.\PHYSICALDRIVE0SeShutdownPrivilegeProgmanProgmanShell_TrayWnd
Source: thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ButtonShell_TrayWnd

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A535A9 cpuid

4_2_00A535A9

Source: C:\Windows\Installer\MSI704E.tmp	Code function: EnumSystemLocalesW,	4_2_00A6E0C6
Source: C:\Windows\Installer\MSI704E.tmp	Code function: EnumSystemLocalesW,	4_2_00A6E1AC
Source: C:\Windows\Installer\MSI704E.tmp	Code function: EnumSystemLocalesW,	4_2_00A67132
Source: C:\Windows\Installer\MSI704E.tmp	Code function: EnumSystemLocalesW,	4_2_00A6E111
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00A6E237
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoEx,	4_2_00A523F8
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoW,	4_2_00A6E48A
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00A6E5B3
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoW,	4_2_00A676AF
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetLocaleInfoW,	4_2_00A6E6B9
Source: C:\Windows\Installer\MSI704E.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00A6E788
Source: C:\Windows\Installer\MSI706F.tmp	Code function: EnumSystemLocalesW,	5_2_001AE0C6
Source: C:\Windows\Installer\MSI706F.tmp	Code function: EnumSystemLocalesW,	5_2_001AE111
Source: C:\Windows\Installer\MSI706F.tmp	Code function: EnumSystemLocalesW,	5_2_001A7132
Source: C:\Windows\Installer\MSI706F.tmp	Code function: EnumSystemLocalesW,	5_2_001AE1AC
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_001AE237
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoEx,	5_2_001923F8
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoW,	5_2_001AE48A
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_001AE5B3
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoW,	5_2_001AE6B9
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetLocaleInfoW,	5_2_001A76AF
Source: C:\Windows\Installer\MSI706F.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_001AE788

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WPS.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A537D5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00A537D5

Source: C:\Windows\Installer\MSI704E.tmp

Code function: 4_2_00A67B1F GetTimeZoneInformation,

4_2_00A67B1F

Source: C:\ProgramData\Microsoft\MF\thelper.exe

Code function: 7_2_00E7C130 memset,GetVersionExW,

7_2_00E7C130

Source: C:\Users\user\AppData\Roaming\WPS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected FatalRAT

Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Yara detected GhostRat

Source: Yara match	File source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Yara detected Nitol

Source: Yara match	File source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Remote Access Functionality

Yara detected FatalRAT

Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Yara detected GhostRat

Source: Yara match	File source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Yara detected Nitol

Source: Yara match	File source: 8.2.thelper.exe.31c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.thelper.exe.2cc0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.thelper.exe.1130000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: thelper.exe PID: 7272, type: MEMORYSTR

Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E50060 XL_DrawSinglelineText,XL_ClipSubBindBitmap,XL_ReleaseBitmap,	7_2_00E50060
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E501C0 XL_DrawMultilineText,XL_ClipSubBindBitmap,XL_ReleaseBitmap,	7_2_00E501C0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E661C0 XL_ClipSubBindBitmap,XL_CloneBitmap,XL_ReleaseBitmap,	7_2_00E661C0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E66130 XL_BindExpRect,XL_BindExpRect,	7_2_00E66130
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E662B0 XL_ClipSubBindBitmap,XL_ReleaseBitmap,	7_2_00E662B0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E50320 XL_PaintTexture,XL_ClipSubBindBitmap,OffsetRect,OffsetRect,OffsetRect,XL_ReleaseBitmap,XL_ReleaseBitmap,	7_2_00E50320
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EC6640 XL_BindExpRect,	7_2_00EC6640
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EC6610 XL_BindExpObject,	7_2_00EC6610
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00EC6890 XL_BindRectExpRect,	7_2_00EC6890
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E78AF0 XL_GetBitmapInfo,XL_ClipSubBindBitmap,IntersectRect,OffsetRect,XL_ClipSubBindBitmap,XL_ReleaseBitmap,XL_ReleaseBitmap,	7_2_00E78AF0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E78D90 XL_ClipSubBindBitmap,OffsetRect,IsRectEmpty,OffsetRect,OffsetRect,XL_ReleaseBitmap,	7_2_00E78D90
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4F2B0 XL_BindMaskSource,	7_2_00E4F2B0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4F780 XL_CreateBindBitmapEx,	7_2_00E4F780
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4F720 XL_CreateBindBitmap,	7_2_00E4F720
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4F8B0 XL_Blend,XL_ClipSubBindBitmap,OffsetRect,XL_ReleaseBitmap,XL_ReleaseBitmap,	7_2_00E4F8B0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E65850 XL_GetBitmapInfo,IntersectRect,OffsetRect,XL_ClipSubBindBitmap,XL_ReleaseBitmap,	7_2_00E65850
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4FA10 XL_FillBlend,XL_ClipSubBindBitmap,OffsetRect,XL_ReleaseBitmap,XL_ReleaseBitmap,	7_2_00E4FA10
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4FB70 XL_StretchBlend,XL_ClipSubBindBitmap,OffsetRect,OffsetRect,OffsetRect,XL_ReleaseBitmap,XL_ReleaseBitmap,	7_2_00E4FB70
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E65CD0 XL_ReleaseBitmap,XL_ClipSubBindBitmap,	7_2_00E65CD0
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E65D10 XL_BindRectExpRect,	7_2_00E65D10
Source: C:\ProgramData\Microsoft\MF\thelper.exe	Code function: 7_2_00E4DF00 XL_ClipSubBindBitmap,	7_2_00E4DF00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	31 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	146 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	122 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	31 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\ProgramData\Microsoft\MF\XLFSIO.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\XLFSIO2.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\XLGraphic.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\XLUE.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\atl90.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\ic.dll	4%	ReversingLabs
C:\ProgramData\Microsoft\MF\libexpat.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\libpng13.dll	3%	ReversingLabs
C:\ProgramData\Microsoft\MF\msvcp90.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\msvcr90.dll	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\sqlite3.dll	5%	ReversingLabs
C:\ProgramData\Microsoft\MF\thelper.exe	0%	ReversingLabs
C:\ProgramData\Microsoft\MF\zlib1.dll	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi5E8D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi5FD6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\thelper.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\WPS.exe	4%	ReversingLabs
C:\Windows\Installer\MSI5BCE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5C5C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5C7C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5D0A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5D97.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6950.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6990.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6A9A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6ABB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6B0A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6BB8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6C74.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6CD3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI704E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI706F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI70BE.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/TEM32	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://www.thawte.com/cps0/	0%	URL Reputation	safe
https://www.wps.cn/privacy/useragreement	0%	Avira URL Cloud	safe
https://www.thawte.com/repository0W	0%	URL Reputation	safe
https://get.wps.cn/feedback/pchttps://official-package.wpscdn.cn/wps/download/WPS_Setup.exe1test	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://shuc-pc-snow.ksord.com)7	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://official-package.wpscdn.cn/wps/download/WPS_Setup_15319.exe	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686%	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)e	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686	0%	Avira URL Cloud	safe
http://www.wps.cn/privacy/privacyprotect2	0%	Avira URL Cloud	safe
http://event.4wps.net	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)EB	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)Ct	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://get.wps.cn/feedback/pc	0%	Avira URL Cloud	safe
http://SVP7.NET:9874/AnyDesk.exe	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c3686b	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll1.2.3	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/2.8.16dcsdk_eventv3.dbdcsdk_dpv3.datadcsdk_cfg.	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com/	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/Ut	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.comot	0%	Avira URL Cloud	safe
https://www.advancedinstaller.com	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com:80/=	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com);B	0%	Avira URL Cloud	safe
http://event.4wps.nethttps://event.wps.comtELAPSE_UPDATE_DYNAMIC_PARAM_MINELAPSE_UPDATE_DYNAMIC_PARA	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ks	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.compDa	0%	Avira URL Cloud	safe
http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1instdirSOFTWARE	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686u	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://downloader.wps.cn/api/v1/link/api/v1/linkloader-pc10.1.xxxx1.0.0zhapplication/json%02xWPS:%s	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v1/app/dynamicUrldnsParseIpserverTimegzipSizesplitSize	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686t	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686z	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686~	0%	Avira URL Cloud	safe
http://svp7.net:9874/UltraViewer.exe	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c368612.2019	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com/NB	0%	Avira URL Cloud	safe
https://downloader.wps.cn/api/v1/link	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36863	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com/	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686:	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36868	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll-DeleteNoRemoveForceRemoveValBDMS	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686.	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686/	0%	Avira URL Cloud	safe
http://dw-collect-debug.ksord.com)	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36860	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686F	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686$)DR	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)q	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/	0%	Avira URL Cloud	safe
http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Y	0%	Avira URL Cloud	safe
https://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Q	0%	Avira URL Cloud	safe
http://shuc-pc-snow.ksord.com)t	0%	Avira URL Cloud	safe
https://event.wps.comr	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686O	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686P	0%	Avira URL Cloud	safe
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
collect.installeranalytics.com	54.224.49.0	true	true	unknown
dw-online.ksosoft.com	116.181.3.214	true	false	unknown
klbv2.wpsdns.com	119.3.210.249	true	false	unknown
shuc-pc-snow.ksord.com	110.249.194.76	true	false	unknown
downloader.wps.cn	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://collect.installeranalytics.com/	true	Avira URL Cloud: safe	unknown
https://downloader.wps.cn/api/v1/link	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/TEM32	WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://get.wps.cn/feedback/pchttps://official-package.wpscdn.cn/wps/download/WPS_Setup.exe1test	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://www.wps.cn/privacy/useragreement	WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://official-package.wpscdn.cn/wps/download/WPS_Setup_15319.exe	WPS.exe, 0000000D.00000003.1913366269.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000446B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1915053692.000000000444A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914405477.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000444F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000441C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com)e	WPS.exe, 0000000D.00000003.1809611089.000000000444E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://curl.se/docs/hsts.html	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686%	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://shuc-pc-snow.ksord.com)7	WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://collect.installeranalytics.com	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	false	Avira URL Cloud: safe	unknown
http://event.4wps.net	WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.wps.cn/privacy/privacyprotect2	WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com)EB	WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll1.2.3	thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://get.wps.cn/feedback/pc	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c3686b	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com)Ct	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/2.8.16dcsdk_eventv3.dbdcsdk_dpv3.datadcsdk_cfg.	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://SVP7.NET:9874/AnyDesk.exe	thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/Ut	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://shuc-pc-snow.ksord.com:80/=	WPS.exe, 0000000D.00000003.1881330582.000000000443C000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1833564279.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000443B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.comot	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ks	WPS.exe, 0000000D.00000003.1833756944.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1913532163.000000000444F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000444A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827440740.000000000444E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.advancedinstaller.com	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com);B	WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://event.4wps.nethttps://event.wps.comtELAPSE_UPDATE_DYNAMIC_PARAM_MINELAPSE_UPDATE_DYNAMIC_PARA	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1instdirSOFTWARE	thelper.exe, 00000007.00000000.1768993886.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000007.00000003.1774208611.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000002.1785928209.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000008.00000000.1770305223.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000002.1782793760.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 00000009.00000000.1771983142.0000000000F9F000.00000002.00000001.01000000.00000007.sdmp, thelper.exe, 0000000C.00000000.1780060388.000000000086F000.00000002.00000001.01000000.00000013.sdmp, thelper.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.compDa	WPS.exe, 00000006.00000003.1783487971.0000000001368000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783467220.0000000001361000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000002.1785170879.0000000001369000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686u	WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	shi5E8D.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686t	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686z	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://downloader.wps.cn/api/v1/link/api/v1/linkloader-pc10.1.xxxx1.0.0zhapplication/json%02xWPS:%s	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v1/app/dynamicUrldnsParseIpserverTimegzipSizesplitSize	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://svp7.net:9874/UltraViewer.exe	thelper.exe, 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, thelper.exe, 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.css	shi5E8D.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686~	WPS.exe, 0000000D.00000002.2960709517.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com/NB	WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com:80/api/dynamicParam/v3/app/6561882c644c368612.2019	WPS.exe, 0000000D.00000003.1826993237.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881962006.0000000004411000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000443B000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	false	URL Reputation: safe	unknown
http://www.fonts.com	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.jpg	shi5E8D.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36863	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com/	WPS.exe, 0000000D.00000003.1810291236.00000000041EB000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686:	WPS.exe, 0000000D.00000003.1833872908.000000000441F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36868	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com)	WPS.exe, 0000000D.00000003.1809492594.0000000004469000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2962702524.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll-DeleteNoRemoveForceRemoveValBDMS	thelper.exe, 00000007.00000002.1786560974.0000000001036000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000008.00000002.1787276109.0000000001776000.00000002.00000001.01000000.00000010.sdmp, thelper.exe, 00000009.00000002.1782646237.0000000000F36000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686.	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://event.wps.com	WPS.exe, 00000006.00000002.1785349047.0000000001382000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 00000006.00000003.1783285429.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	thelper.exe, 00000007.00000003.1774208611.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, thelper.exe.1.dr	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686/	WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2963810700.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c36860	WPS.exe, 0000000D.00000003.1914796126.000000000440A000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-collect-debug.ksord.com)	WPS.exe, 00000006.00000002.1783748911.00000000000E1000.00000040.00000001.01000000.00000006.sdmp, WPS.exe, 0000000D.00000002.2958502407.00000000000E1000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686F	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686$)DR	WPS.exe, 0000000D.00000003.1833564279.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004441000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1833908101.0000000004441000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.com	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, 5559f9.msi.1.dr	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686U	WPS.exe, 0000000D.00000003.1833872908.000000000441F000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827603871.0000000004415000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1809611089.0000000004415000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.htmlN	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Y	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stat.download.xunlei.com:8080/?aid=1009&id=%d&peerid=%s&click=1	thelper.exe	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0/	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	false	URL Reputation: safe	unknown
http://shuc-pc-snow.ksord.com)q	WPS.exe, 0000000D.00000003.1881718056.0000000004455000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1881330582.000000000444E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/	WPS.exe, 0000000D.00000003.1815264033.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/repository0W	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, MSI704E.tmp.1.dr, MSI6CD3.tmp.1.dr, MSI5C5C.tmp.1.dr, MSI6C74.tmp.1.dr, 5559f9.msi.1.dr, MSI706F.tmp.1.dr, MSI6BB7.tmp.1.dr, MSI5D0A.tmp.1.dr	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686Q	WPS.exe, 0000000D.00000003.1913366269.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1914405477.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1815394137.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000002.2960709517.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827340173.0000000000E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shuc-pc-snow.ksord.com)t	WPS.exe, 0000000D.00000003.1833756944.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827656785.0000000004453000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1826993237.000000000444E000.00000004.00000020.00020000.00000000.sdmp, WPS.exe, 0000000D.00000003.1827440740.000000000444E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://event.wps.comr	WPS.exe, 0000000D.00000002.2960709517.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686O	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686P	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	WPS.exe, 0000000D.00000002.2964697232.0000000005852000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dw-online.ksosoft.com/api/dynamicParam/v3/app/6561882c644c3686c	WPS.exe, 0000000D.00000003.1809611089.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
119.3.210.249	klbv2.wpsdns.com	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
116.181.3.214	dw-online.ksosoft.com	China	133119	UNICOM-CNChinaUnicomIPnetworkCN	false
54.224.49.0	collect.installeranalytics.com	United States	14618	AMAZON-AESUS	true
110.249.194.76	shuc-pc-snow.ksord.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1475158
Start date and time:	2024-07-17 17:09:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi renamed because original name is a hash value
Original Sample Name:	WPS v76.23.66.msi
Detection:	MAL
Classification:	mal100.troj.evad.winMSI@17/62@4/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 62% Number of executed functions: 26 Number of non-executed functions: 384
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

Simulations

Behavior and APIs

Time	Type	Description
11:10:14	API Interceptor	5x Sleep call for process: WPS.exe modified
16:10:12	Task Scheduler	Run new task: user-PC path: C:\ProgramData\Microsoft\MF\thelper.exe
16:10:12	Task Scheduler	Run new task: user-PC-2 path: C:\ProgramData\Microsoft\MF\thelper.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
collect.installeranalytics.com	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	54.165.254.88
	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse	54.227.134.57
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse	54.221.197.204
	speke.msi	Get hash	malicious	Unknown	Browse	54.165.34.233
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	54.158.107.210

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HWCSNETHuaweiCloudServicedatacenterCN	botx.mips.elf	Get hash	malicious	Mirai	Browse	124.71.66.9
	SRWlimL4k6.exe	Get hash	malicious	CobaltStrike	Browse	124.71.36.234
	SRWlimL4k6.exe	Get hash	malicious	CobaltStrike	Browse	124.71.36.234
	6o63snaetO.exe	Get hash	malicious	Unknown	Browse	139.9.43.12
	6o63snaetO.exe	Get hash	malicious	Unknown	Browse	139.9.35.91
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.16736.4797.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	121.37.199.72
	gw3yTM2uiZ.elf	Get hash	malicious	Mirai	Browse	139.9.27.39
	c2swVFiBVZ.elf	Get hash	malicious	Mirai	Browse	139.9.138.171
	IMG_00110724.exe	Get hash	malicious	FormBook	Browse	121.37.199.72
	SecuriteInfo.com.Win32.PWSX-gen.17883.22231.exe	Get hash	malicious	FormBook	Browse	121.37.199.72
UNICOM-CNChinaUnicomIPnetworkCN	185.208.158.215-x86-2024-07-14T08_54_06.elf	Get hash	malicious	Unknown	Browse	120.54.109.21
	s4WsI8Qcm4.elf	Get hash	malicious	Mirai, Moobot	Browse	106.74.102.53
	544fo2biO9.elf	Get hash	malicious	Mirai, Moobot	Browse	106.74.126.95
	CnqpVfDyUH.elf	Get hash	malicious	Mirai	Browse	106.74.151.42
	s8y4CBbFHW.elf	Get hash	malicious	Mirai	Browse	106.74.56.90
	SecuriteInfo.com.Trojan.Siggen23.13161.15240.4676.exe	Get hash	malicious	Poisonivy	Browse	120.52.183.129
	Xe3eO9R1Ra.elf	Get hash	malicious	Mirai	Browse	106.74.102.70
	uqGHhft2DO.elf	Get hash	malicious	Mirai	Browse	120.54.33.170
	SecuriteInfo.com.Trojan.Siggen17.35688.9477.7627.exe	Get hash	malicious	Poisonivy	Browse	120.52.183.129
	SecuriteInfo.com.Trojan.Siggen17.35688.9477.7627.exe	Get hash	malicious	Unknown	Browse	120.52.95.247
AMAZON-AESUS	https://inpeak.xyz/	Get hash	malicious	Unknown	Browse	44.212.246.194
	x86.elf	Get hash	malicious	Mirai	Browse	18.212.5.67
	arm7.elf	Get hash	malicious	Mirai	Browse	23.21.227.40
	https://u7161484.ct.sendgrid.net/ls/click?upn=u001.hSwgV93oKqJ8ZvQ-2F-2Bg69lRG3z5eH5AhV-2BJUjpvOnP47pFgt6vcHkzmMENxzqwp-2BRKeOD_zoLhCpkIy9Do8JtP-2BvPGbCKd-2BnnQhX22X7a9bdbWbCC5gFgFTIeDJ6cwijFzpwNISqmNkWsSGKxD-2FNSJjw0k1WplZHv6o0IxvsHmD61mU5ysV55-2B96DI72sCPsjm4NC818V0m0IM3im6ASY16u81LTenkvC-2FNvpnXD8McPjpGGauIb-2BM2U-2F5-2B1mP498QsMXa-2B6AhMNBfWHNfBJ5LHwc-2FEyMJR3z91eyiHhufIom4eLGOsOMu3-2Buvb1QWgf-2Fm28xUzJQB-2F0SFg3lJlq9Unc-2BGXVXdMHoo1zYap4ERXKPHz6fFTfg-2ByjNk2fx6gMZdF5wLdJ22iNNOIfJYnQmbrLKw8amK4pf2c0srhPNUjajemS3a0XAglQQfY-2FcnYJ8JCOteF8AXW7pHPGp1k6-2FUQvEbZwCojFrVmaSNpy4g9cIMi5Wb84VMjWDQkOvt1cLwqNYONTs-2FUB2VE3s9Hh05SQ7qgXlFKEeLNAjlDc8oLcdgcfk-3D	Get hash	malicious	Unknown	Browse	3.5.66.119
	https://u7161484.ct.sendgrid.net/ls/click?upn=u001.hSwgV93oKqJ8ZvQ-2F-2Bg69lRG3z5eH5AhV-2BJUjpvOnP47uzh2T1CKCZsAM0vhAdUI47WLZRLHbp0nZGfR-2F8WiTSw-3D-3DFKNC_zoLhCpkIy9Do8JtP-2BvPGbCKd-2BnnQhX22X7a9bdbWbCC5gFgFTIeDJ6cwijFzpwNISqmNkWsSGKxD-2FNSJjw0k1WplZHv6o0IxvsHmD61mU5ysV55-2B96DI72sCPsjm4NC818V0m0IM3im6ASY16u81LTenkvC-2FNvpnXD8McPjpGGauIb-2BM2U-2F5-2B1mP498QsMXa-2B6AhMNBfWHNfBJ5LHwc-2FEyMJR3z91eyiHhufIom4eLGOsOMu3-2Buvb1QWgf-2Fm28xUzJQB-2F0SFg3lJlq9Unc-2BGXVXdMHoo1zYap4ERXKPHz6eWGtoTBwyrUU9Pe5EWpAHMKw-2FmkMf-2FZqzwzxp6NZ5-2BmhlhChFLNLwKsCa-2F-2F11pJq78P2-2B7lv0W-2Fg16BvYyiRmGTE8uEeeeSyoRjaFkotfH-2Fw-2Ff7Lwf1l0eCoqAReiq0n82f3hl5klibAYhaJL8gD1m6Qn7H0Wu4jo84QkEjC0EIdszF8MNtqnVNqkm3DhB4Qg-3D	Get hash	malicious	Unknown	Browse	3.233.158.34
	https://u7161484.ct.sendgrid.net/ls/click?upn=u001.hSwgV93oKqJ8ZvQ-2F-2Bg69leIE994xSSqH5GRhtM9LxJzylLyMW1jQS6PNMKUTywQkgGBJbO1mHcNkyMZO2sZ7mwzJuAJ6NoVCfboOiycjoBmRmJ21uQ8d5ZLyjgcyftPoZbV0x6srcMnq4qnRbBu0O7jBwUV-2FDvozeHcLk6Xg-2Feg-3DwPJF_zoLhCpkIy9Do8JtP-2BvPGbCKd-2BnnQhX22X7a9bdbWbCC5gFgFTIeDJ6cwijFzpwNISqmNkWsSGKxD-2FNSJjw0k1WplZHv6o0IxvsHmD61mU5ysV55-2B96DI72sCPsjm4NC818V0m0IM3im6ASY16u81LTenkvC-2FNvpnXD8McPjpGGauIb-2BM2U-2F5-2B1mP498QsMXa-2B6AhMNBfWHNfBJ5LHwc-2FEyMJR3z91eyiHhufIom4eLGOsOMu3-2Buvb1QWgf-2Fm28xUzJQB-2F0SFg3lJlq9Unc-2BGXVXdMHoo1zYap4ERXKPHz6eBGax1u9Oya8RR2OEqVpFAzTGKLJpLw4mSSRnBENm6ouw3lgXwHAwc500czryRnrL8kAVH-2B-2BVilxLDi-2ByigxXjUWFgutNk8d1XKVELr-2Bc2f7Gx-2BYtM04qJvRxKQPDc6kwwnHhaO0xmjzDVh5wIL-2B0bUikk40nIqmHSaXtgmNSl6HzvQPXfDU3J0LLWIsgLi94-3D	Get hash	malicious	Unknown	Browse	3.5.70.110
	http://exhibitprosper.com/r5K0.aspx?4XVH7cbbbd9tkD1cc3JlHcwglSchg7pcmcpJJhf9sc	Get hash	malicious	Phisher	Browse	3.212.220.243
	cc00980_.exe	Get hash	malicious	Unknown	Browse	54.158.232.70
	ziprar.exe	Get hash	malicious	Unknown	Browse	54.147.67.214
	https://1wv.ephypsyne.com/V50J/#ZGFuaWVsQHByZW1pZXItZXhwZXJ0cy5kZQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	44.212.226.157

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\ProgramData\Microsoft\MF\atl90.dll	Firefox-x64.msi	Get hash	malicious	Unknown	Browse
C:\ProgramData\Microsoft\MF\atl90.dll	https://www.glarysoft.com/aff/download.php?s=GU	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\5559fb.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	386512
Entropy (8bit):	6.4147516724434235
Encrypted:	false
SSDEEP:	6144:nBKwXYBWHRuEFW9RzLLhrUmdHDZ19MhVBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mhe:MaHRuEs3Xmm9DZEkaHRuEs3Xmm9DZEM
MD5:	CAA8225E7FEEFFAAB81721CDF30B1970
SHA1:	C732AD9D1A82CD123017E037A2DB40D067D7AD86
SHA-256:	2DC68FCE2E487CA30F776E8D5D2615DD99B21F0B997CF9F2FB9B84769625FF6F
SHA-512:	B4A44D97C6484351BCD0DF526181D8E81FB88A425E655C62CEADDB44FED38A513B75EB16661A15E71AF6D668FE027C0BF3332D1226DEED464514B66FF9BC1476
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@FY.X.@.....@.....@.....@.....@.....@......&.{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}..WPS Office v76.23.66).WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi.@.....@B..L.@.....@........&.{7DD8A22E-1308-45B2-86D0-5CB5038DFF9C}.....@.....@.....@.....@.......@.....@.....@.......@......WPS Office v76.23.66......Rollback...V.n.d\O:.....RollbackCleanup.. Rd..Y.N.e.N...e.N:. .[.1.]. .....ProcessComponents...f.e.~.N.l.Qh...&.{A19BE9EC-E940-4615-A9BA-832DC870C667}&.{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}.@........AI_RollbackTasks2...V.n,g0W...{:g.N.v.N.R...R...N.R.T:. .[.1.]. .L...AI_RollbackTasks2.@.-........MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@............

C:\ProgramData\Microsoft\MF\Mi.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	203784
Entropy (8bit):	6.586947560295334
Encrypted:	false
SSDEEP:	3072:5TRmbICt25LZseWDzoPZ6WS6BLfvgaSlpcD+05fC:5VljSzkPDNGEfC
MD5:	75CBB4F1E63E245BD3462CAB5CB5BE2C
SHA1:	2961F8579ED879CDC1BD50DDE56C6441965818ED
SHA-256:	DEC9DF011A3EE5FB9A9544BDA976EEC41667F344BC0B3166392F4CFFFAF3F7C6
SHA-512:	F7620741CF450DA09981F8FC8449D79981490696B84B65F35354F5BE7D0D3A6ED6CE8A08334E50F5B9D81DDAAEBE30B4FDB6DA6FD8015B0270477D761E2EE642
Malicious:	false
Reputation:	low
Preview:	.....XU..............h....h....Rh}<8.P...............SUVWjkXjef..$....3.XjrYjn[jlZj3f..$....f..$....Xj2f..$....Xj.f..$....Xjdf..$....X..$.....l$4..$......$......$......$......$....f..$....f..$....f..$....f..$....f..$....f..$.....D$<S.T$=f.D$>ee.D$@pf.D$PLo.D$Ra.D$Sf.D$TLi.D$Vb.L$W.D$Xa.L$Yf.D$ZyAf.D$DVi.L$Ff.D$Gtu.D$Ia.T$J.D$KA.T$L.T$Mf.D$Nocf.D$\Vi.L$^f.D$_tu.D$aa.T$b.D$cP.L$d.D$eotec.D$it.$....F..$.....$....ushI..$....f.$....st..$.....$....ucti.$....ojeY..$.....L$m.L$t.L$y..$...........$.....$....Cach.D$lG.D$ntNatf.D$riv.D$uSystf.D$zmI.\$\|f.D$}fof.$....Rt..$.....$....A..$......$....f.$....Fu..$.....$....ctio..$....f.$....Ta.$....b..$.....w.....A.^...k......$....j...$....Xf..$....f..$.....D$.P..$.....\$4PUU..j._.D$Df.\|$..D$..D$4PU.D$.f.\|$.P.t$(..j.Xf.D$.f.D$..D$\.D$...$....PU.D$.P.t$(..j.Xf.D$.f.D$...$.....D$...$....PU.D$.P.t$(..j.^.D$lf.t$..D$...$....PU.D$.f.t$.P.t$(..j.Xf.D$.f.D$..D$<.D$...$....PU.D$.P.t$(...$....f.t$..D$...$....PU.D$.f.t$.P.t$(..D$Pf.\|$..D$...$....

C:\ProgramData\Microsoft\MF\Microsoft.VC90.ATL.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	466
Entropy (8bit):	5.038556089104879
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+MVI4gVW/wnbEUyG:2dtXD+u/eVN40+MVI4gAwnhJ
MD5:	B41644A01C05740576B4E77662C7E86C
SHA1:	91D9A44EE27F321B8EB844709555E5CDA4D8D469
SHA-256:	A9A98FC7062262A47A1C0727339C760D18589B8549E4267762F7F4C88A103632
SHA-512:	C2B29CE13D2C84C4165196DF1A561B1DE35938F93714580B728A2FB2AF7C4606ABC410077645261250ABF73E66CCA64683715E3C3B1AAD6FDDFFDBAEFA8704A4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.ATL".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="ATL90.dll" />..</assembly>..

C:\ProgramData\Microsoft\MF\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1857
Entropy (8bit):	5.379091022433406
Encrypted:	false
SSDEEP:	48:3SlK+6g4R09kkKv/zRs009kkKazS4S0309kkKBzY:CltCRXkq/O0XkzOfKXk48
MD5:	4F9ED5EFA4F7B75BCFE0F36C36EE5CB6
SHA1:	29F568508A65F5177C6044544248893A876A666F
SHA-256:	FF718390133B400EE679177B2902BBB918DB148BBB4ABABA03D0A1DF325B3303
SHA-512:	A94AA869B8420D3965FAD7B05E1E894E8CA00465CD8C2BE2AC135F44D0689AFA7257BB468C69B7BB33BBB036D6B66FBC693C964BF17A85A209AEEE9F8DFFC3CD
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="e0dcdcbfcb452747da530fae6b000d47c8674671"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>KSaO8M0iCtPF6YEr79P1dZsnomY=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="81efe890e4ef2615c0bb4dda7b94bea177c86ebd"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig

C:\ProgramData\Microsoft\MF\XLFSIO.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	5.9232837087356875
Encrypted:	false
SSDEEP:	12288:Ewh/kGKUFSmBjrmdimavq3AIlbDpEYtlWKFRQQuuf8kn:r/0UFSyrmdimavvIppESlDg8
MD5:	A06090C5F2D3DF2CEDC51CC99E19E821
SHA1:	701AC97C2FD140464B234F666A0453D058C9FABF
SHA-256:	64FFDFFB82FC649E6847B3C4F8678D9CCA0D5117FA54C9ABBB746625D3FEEF89
SHA-512:	541804DB74A25FC5F50801F23B4D9F2BE788D3C95D3D23DD8098F4C8888D1FC808E6EB6959C458965C639EA28B594A87DFF7F3A89C4750C109B29B573C4535CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._..I............P......P......P.......).......).......)..\...P..........B.....................z.............Rich....................PE..L....Sf...........!...(.....V......\|\.......................................p............@.........................P...0.......(.......<........................L......8...............................@............................................text...p........................... ..`.rdata..............................@..@.data....>.......$...~..............@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc...W.......X..................@..B................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\XLFSIO2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214088
Entropy (8bit):	6.645761471364513
Encrypted:	false
SSDEEP:	6144:BGx1XQVx0mcFRq3uOFyXsTBqxQmsOy7YZSM:BaXQVx0mwA3uEQsTsxHVX
MD5:	1BC7AF7A8512CF79D4F0EFC5CB138CE3
SHA1:	68FD202D9380CACD2F8E0CE06D8DF1C03C791C5B
SHA-256:	EF474B18F89310C067A859D55ABD4E4F42FDAC732E49EAFE4246545E36872A62
SHA-512:	84DE4D193D22A305BE2BA28FC67BD1CCCF83616CEAD721E57347F1B2E0736D351FEF1ABF168F7914CAA1BCC7A72DB43769991016673CD4646DEF544802EE8960
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&..\|b.m/b.m/b.m/../c.m/k../m.m/b.l/..m/k../j.m/k../z.m/k../Y.m/k../c.m/k../c.m/k../c.m/Richb.m/................PE..L......W...........!.....N..........K7.......`...............................P......)~..............................@.......t...d.......................H4... ......0b...............................................`...............................text....L.......N.................. ..`.rdata..3....`.......R..............@..@.data...............................@....uestat.l...........................@....rsrc...............................@..@.reloc..."... ...$..................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\XLGraphic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	748104
Entropy (8bit):	6.750926609548472
Encrypted:	false
SSDEEP:	12288:YtFRL0ChvivVwOE5wOn2ML0TngpwBZuU2XvRAQfEWmd5eTU:YtFRL0ChvivVwOE5w20TnTuU2XvRABZN
MD5:	74C75AE5B97AD708DBE6F69D3A602430
SHA1:	A02764D99B44CE4B1D199EF0F8CE73431D094A6A
SHA-256:	89FBB6B1CA9168A452E803DBDC6343DB7C661AD70860A245D76B3B08830156E2
SHA-512:	52C5F7E00DFFB1C0719D18184DA2CC8EC2AD178B222775F167B87320F0683A3C2846E30190BC506F12D14C07FA45896935B3D4AC396BAA14D7564996E35C2ADA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C&..C...C...C...C...C...C...C...C...C...C...C...C...CI..C...C...C...C.C...C...C...C...C...C...CRich...C........PE..L...#..W...........!................&........0......................................G.......................................<........0..,............6..H4...@..\-..03..............................h...@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....uestat.@.... ......................@....rsrc...,....0......................@..@.reloc...9...@...:..................@..B................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255048
Entropy (8bit):	6.644417096667236
Encrypted:	false
SSDEEP:	6144:bo/eYYpwVt0D0ihbv+52I5bwf3vXOboZRLkhGK4dhrrOyMTJ:bYeYYpMt0DZb25SvPRLYGvdp4J
MD5:	5362CB2EFE55C6D6E9B51849EC0706B2
SHA1:	D91ACBE95DEDC3BCAC7EC0051C04DDDDD5652778
SHA-256:	1D7519ACCA9C8A013C31AF2064FBC599A0B14CFD1DFB793A345FAB14045FED40
SHA-512:	DBD591C3D0B9847D9CEF59277C03EC89E246DB0E54B58FBBE9D492B75CDCB32D75444012CDFB1C77376D15DB7FDE1F74E694D2487C481CE29A2133342B91E1F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................{.)......*.......,.......!.....<.....;.....-......+...........Rich...................PE..L...?..W...........!................m................................................u..............................0v......Te..x.......\...............H4..........`...............................X@..@...............<............................text...l........................... ..`.rdata...\|.......~..................@..@.data...\............t..............@....uestat.D............z..............@....rsrc...\............\|..............@..@.reloc...'.......(..................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\XLUE.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2561608
Entropy (8bit):	6.3415727262614014
Encrypted:	false
SSDEEP:	24576:IEaZQmfa1YLPVtw8zDhpau3PhP3jYs8XmUHX9vYPiVoy/Dnxjhvyz:IZuqPTXzDF/JMs8dHX9/VoyLnxjhv
MD5:	0ABBE96E1F7A254E23A80F06A1018C69
SHA1:	0B83322FD5E18C9DA8C013A0ED952CFFA34381AE
SHA-256:	10F099F68741C179D5AD60B226D15233BB02D73F84CE51A5BBBBC4EB6A08E9D4
SHA-512:	2924E1E11E11BD655F27EB0243F87002A50A2D4B80E0B0E3AD6FD4C3D75C44222FAB426FCAA695881B0093BABF544E8AEEE50A065EA92274145B0F88B1DB0C58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...[...[...[. .....[.......[......[.......[.......[.......[...Z...[.......[.......[.......[.......[.Rich..[.................PE..L.....W...........!.....j...t...............................................`'......2'..............................!..+...[!.h.....%...............&.H4... %.8... ...................................@...............d............................text....i.......j.................. ..`.rdata...B.......D...n..............@..@.data.........!.......!.............@....uestat.......$.......$.............@....uestr........%.......$.............@..@.rsrc.........%.......$.............@..@.reloc...?... %..@....$.............@..B........................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\atl90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159032
Entropy (8bit):	6.5642092957903335
Encrypted:	false
SSDEEP:	3072:5HJXmwllbA995vqNRoom9OSft0osAZT/NX+cZSyh53Pa63CLZ/V:5pXmwzA99hsaN9Jt0osARB+cEybyV
MD5:	338F1F7137860D3BF6094941AC2A9BA2
SHA1:	EE174FC0F8CFFA3B5717EAF17C97713099D69AD7
SHA-256:	5122E4A2E48E34326B6267D48BD007DA76A15243B90550EA565F1654CCC64877
SHA-512:	DA9DD23BA13928F1623566D10CA155D2A06112844CD7AE8FF0DDB5B31624E7E7E59289AA2B7B7568DA4CEC0070CDDC925DADE8312501415ADE0F4CD411B554B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Firefox-x64.msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v.92..j2..j2..j.j.j0..j,.gj"..j,.qjG..j.j.j1..j2..j..j,.vj...j,.`j3..j,.fj3..j,.cj3..jRich2..j........PE..L...AOYJ...........!.........~.......2.............x.................................v....@.........................p...........(....P..."...........V..8............................................[..@............................................text...@........................... ..`.data....0..........................@....rsrc...."...P...$..................@..@.reloc...'.......(..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\ic.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1662976
Entropy (8bit):	5.6071102946447295
Encrypted:	false
SSDEEP:	12288:qAXAV394lax33Vfpt3lWLzmhM2hM4yVf5dljiiQuu+HXKBodAZXFdpliMfTglZzb:7wV3y433HtO2Whl4BodAZXdliMfElZz
MD5:	BB1197BEA58B158554FA3FA25866D1EA
SHA1:	CAE7F395ED42FA2DD3362F4C816FB678072FEB49
SHA-256:	20A04729FDD8E02E2FB5BE79AF130C364D0F3CE85E49478A6819A0A2020AE844
SHA-512:	F80B7669DA861400A5B5ADD8148B85CC62994819E3A3A2220475D7EC2FC31F70BC3C683D5A5D6043B319B428A0AC47B9B41201AEE7ABA5D5CC927A8556DD7B73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8~..V-..V-..V-!.U,..V-!.S,v.V-!.R,..V-..U,..V-..S,..V-..R,..V-!.W,..V-..W-..V-n.S,..V-n.V,..V-n..-..V-...-..V-n.T,..V-Rich..V-................PE..L...4.vf...........!.....P...(......H........................................@#...........@.........................P.!.U....A".(....p".......................".@...@.!.8...........................x.!.@............@"..............................textbss.r...............................text....N.......P.................. ..`.rdata...............T..............@..@.data...d?...."..$...j..............@....idata..\....@".....................@..@.msvcjmcN....P".....................@....00cfg.......`".....................@..@.rsrc........p".....................@..@.reloc..N.....".....................@..B........................................................................................................................

C:\ProgramData\Microsoft\MF\libexpat.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684032
Entropy (8bit):	5.737753396210417
Encrypted:	false
SSDEEP:	12288:c4rJNmF1EymyCOf1Z4fJGtQse4XHIOEBeDbGp:c4KEymyC4kMtQe
MD5:	5FF790879AAB8078884EAAC71AFFEB4A
SHA1:	59352663FDCF24BB01C1F219410E49C15B51D5C5
SHA-256:	CCECA70F34BBCEC861A02C3700DE79EA17D80C0A7B9F33D7EDD1357A714E0F2F
SHA-512:	34FBAFFC48912E3D3FA2D224E001121E8B36F5BE7284A33EB31D306B9A5C00DE6E23A9FDC1A17A61FB1371768F0B0E30B9C6E899A08C735FC70482D5AA8EA824
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:qxD:qxD:qxD3..D.qxD3..D+qxD...D9qxD:qyDdqxD3..DIqxD3..D;qxD$#.D;qxD3..D;qxDRich:qxD........PE..L...C}.X...........!................@K.............!................................................................p...M....p..(...............................TJ..P................................................r...............................textbss. ...............................text........@...................... ..`.rdata...Y.......Z..................@..@.data...@8...0......................@....idata..~....p......................@....rsrc...............................@..@.reloc..gV.......X..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\libpng13.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	6.302841870152543
Encrypted:	false
SSDEEP:	3072:xtGfTu0eJRrrVBbgSTftWgNYVkrlFW/m:xYAR1B5WgSVO
MD5:	BB1922DFBDD99E0B89BEC66C30C31B73
SHA1:	F7A561619C101BA9B335C0B3D318F965B8FC1DFB
SHA-256:	76457F38CBBDD3DCE078A40D42D9AC0DC26AE1C4BB68AB9C880EB7FFB400FD99
SHA-512:	3054574DD645FEB1468CEE53DB2FD456E4F923EAF5FD686557A01C72C0572B19D70F3885D47FE42E97CDF7CCC2C674A6E966FF19668907CF7828E0A943CF474A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...R..R..R..i.R..x.R....R..o.R..R..R....R..n.R...h.R..m.R..Rich.R..........................PE..L...C}.X...........!.........`...............0.....!................................zS...............................b.......]..P....................................................................\..@............0...............................text............................... ..`.rdata...I...0...J..................@..@.data...l............`..............@....rsrc................b..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\msvcp90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568832
Entropy (8bit):	6.529348877830445
Encrypted:	false
SSDEEP:	12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
MD5:	6DE5C66E434A9C1729575763D891C6C2
SHA1:	A230E64E0A5830544A25890F70CE9C9296245945
SHA-256:	4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
SHA-512:	27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\msvcr90.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890160476095281
Encrypted:	false
SSDEEP:	12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
MD5:	E7D91D008FE76423962B91C43C88E4EB
SHA1:	29268EF0CD220AD3C5E9812BEFD3F5759B27A266
SHA-256:	ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
SHA-512:	C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\mt.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1564672
Entropy (8bit):	5.612198501569935
Encrypted:	false
SSDEEP:	12288:16D0N87G0YhT5pUwy5Vk+s44iiguupiyeYUvUfVtBJ78XdmfOsKg0uozkiKj:JhtpUb8+5JibUfVtBJ7ImfOsKg9P
MD5:	9DED3FDFFB0FF7F62E6A0A7F996C0CAF
SHA1:	FCC959B28A32923CCDB1CA4E304C74A31DEDE929
SHA-256:	87AAB1DB611ADB132F503C08C32DC4EFC23C9216D97E918F7279F86920701C93
SHA-512:	A7E7CB96A78827B01E71C595CA0D106EAF7AFE35D4A548E5BECCF0B009CC02D33274822958DCA4998A427D8B4027EAEFE99B40B3648E24730C81DF34EAB32BA0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........XR.V9<.V9<.V9<..A?.X9<..A9..9<..A8.B9<..?.E9<..8.F9<..9..9<..A=.U9<.V9=..9<.E.9.T9<.E...W9<.E.>.W9<.RichV9<.........PE..L...{..f...........!...(.....F..............................................p!...........@.................................. .(..... .&..................... ........8..............................@............. ..............................textbss.+...............................text........@...................... ..`.rdata...T.......V..................@..@.data....=...P ..$..................@....idata........ .....................@..@.msvcjmc...... ......<..............@....00cfg........ ......>..............@..@.rsrc...&..... ......@..............@..@.reloc........ ......D..............@..B................................................................................................................................................

C:\ProgramData\Microsoft\MF\sqlite3.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	484352
Entropy (8bit):	6.775750589015898
Encrypted:	false
SSDEEP:	6144:oiEuCNzvQuHEXzGlTp1gm26Xwq1BaU1LchARlZvugIqLR7nfGJTaaSZjboondwwX:iuoQDXzGtpfAo46vsg7RLgTalZbdww
MD5:	36879056AD692B8FFD0AA8D4B8D95C6C
SHA1:	3835101B053FB37E40871C8E84341B7A0545F833
SHA-256:	FD1C5409E0B0E06C4D5AD793663800C20836CFED4BF9265AE6C5213878F58A1B
SHA-512:	CFAD7FDB3227E66F7460CAB670D2C99DDE119CA2090C8BB3AD467D9B3193CE470DA18D43C1E5CF266671DB47F841524C54F5E3481900F4499A2315876A850A5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L{..L{..L{..E.\.N{..E.Z.@{..E.L.B{..E.K.N{..k...O{..L{..={..E.E.I{..E.].M{..R)[.M{..E.^.M{..RichL{..........PE..L...C}.X...........!.....`..........Ld.......p.....!.................................1....@.....................................<....P..h....................`...'...q..................................@............p..t............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data.... ... ......................@....rsrc...h....P......................@..@.reloc..,+...`...,...8..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\thelper.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	231896
Entropy (8bit):	6.608894718500493
Encrypted:	false
SSDEEP:	6144:gVjUqyblKOrj8xp2UTakqtkJ9qqD/l6DLxYOnHwjiY3DmzhIaZUNyF:Kj7ywi8xJTaP4Aqrl6JpYTUh5ZU+
MD5:	17749F66292F190EF93652EB512C5AB7
SHA1:	E2F651AA9D37404063FFC79E920787C9D3E71FDB
SHA-256:	0AA17EE66B8DAE520E82A94388B1A1D603EC2AED20C464D6CAC9A521D4167F24
SHA-512:	2EF192A191DC40A16C9B8768E749175C1A57319AB896809691EFFCC5DE61C4A38FD8A8388B8907A1985E505907A8529F4D10990E362831092C75DAFB8900B13E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.8...V...V...V.......V.......V.......V.8.;...V.......V.......V.8.-...V...W...V.......V.......V.......V.Rich..V.........................PE..L.....-U............................$.............@.................................F.....@..................................p..\|....................n.......`...,..@................................5..@............................................text...^........................... ..`.rdata..\...........................@..@.data...............................@....rsrc...............................@..@.reloc..4?...`...@..................@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\MF\zlib1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.721700259681837
Encrypted:	false
SSDEEP:	768:5yiLYWSoXtIKCwH9Tu0eDVXeSE04rPRsPgt+ytSoUnToIf1AIOjIOyQH0L7ClW:D9dGwUDV7TP1nToIfeIOjIOyQH0LW
MD5:	37163AACC5534FBAB012FB505BE8D647
SHA1:	73DE6343E52180A24C74F4629E38A62ED8AD5F81
SHA-256:	0A6357A8852DAAAFE7AED300E2F7E69D993CAC4156E882BAA8A3A56B583255BA
SHA-512:	C3BED1C9BC58652ED16B162ED16A93CF7479A0492DB7E6EA577001DBE859AFFC0B20387D93D23E06E73F49F395E4C9A5A07680F000EBB82D32269742C16A5242
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................&......1......9...............6...... ......'......!......$.....Rich............................PE..L...C}.X...........!.........`....................g".........................0......GR..................................]...\|...<.......(.................... .......................................................................................text.............................. ..`.rdata...J.......L..................@..@.data...............................@....rsrc...(...........................@..@.reloc..v.... ......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\6696c9562ff508bfba81ef0a\76.23.66\{8AE698CD-4D24-4723-A62C-73BE1AFF81EE}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13424
Entropy (8bit):	5.41175569234046
Encrypted:	false
SSDEEP:	384:2uROmSsF/uhTvdgbZiSBAk17H9l7/K2hYwnz5BFPf25w/ZWhrRL:2uRnSsF/uhTvdgbZiSBAk17dl7KOYwnq
MD5:	9FB82CAF11DA3DDB825D6BDB2671CCD8
SHA1:	72D7F187602D4AEE60189767C4FBDA5CF6087307
SHA-256:	5ABC52C3D08CBC17E4D8FB16F53CBC2C7412F3078BF68AF139BC44A7AC6FB668
SHA-512:	942A0DB7AFDD47D0E208A595C05090C4168B017BB833922AA858A7C0FADCC2333F6EC827209698CA9C3A01AEC1CED151EBB2916A32C709DD70F0DA6649DCCD62
Malicious:	false
Preview:	[Hit {5AD6EF52-D89E-40BF-9450-96963DEFD840}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 6696c9562ff508bfba81ef0a..Application Version = 76.23.66..Client ID = 700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9..Session ID = {8AE698CD-4D24-4723-A62C-73BE1AFF81EE}....[Hit {639B4B68-6E6E-457B-A851-51B943D8A409}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 6696c9562ff508bfba81ef0a..Application Version = 76.23.66..Client ID = 700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9..Session ID = {8AE698CD-4D24-4723-A62C-73BE1AFF81EE}....[Hit {52F4FAD0-1222-4C23-AF9C-5754FEBD105D}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 6696c9562ff508bfba81ef0a..Application Version = 76.23.66..Client ID = 700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9..Session ID = {8AE698CD-4D24-4723-A62C-73BE1AFF81EE}....[Hit {F3351640-AB1C-4623-A214-A41C694876CB

C:\Users\user\AppData\Local\Temp\shi5E8D.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi5FD6.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\thelper.exe

Download File

Process:	C:\ProgramData\Microsoft\MF\thelper.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	231896
Entropy (8bit):	6.608894718500493
Encrypted:	false
SSDEEP:	6144:gVjUqyblKOrj8xp2UTakqtkJ9qqD/l6DLxYOnHwjiY3DmzhIaZUNyF:Kj7ywi8xJTaP4Aqrl6JpYTUh5ZU+
MD5:	17749F66292F190EF93652EB512C5AB7
SHA1:	E2F651AA9D37404063FFC79E920787C9D3E71FDB
SHA-256:	0AA17EE66B8DAE520E82A94388B1A1D603EC2AED20C464D6CAC9A521D4167F24
SHA-512:	2EF192A191DC40A16C9B8768E749175C1A57319AB896809691EFFCC5DE61C4A38FD8A8388B8907A1985E505907A8529F4D10990E362831092C75DAFB8900B13E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.8...V...V...V.......V.......V.......V.8.;...V.......V.......V.8.-...V...W...V.......V.......V.......V.Rich..V.........................PE..L.....-U............................$.............@.................................F.....@..................................p..\|....................n.......`...,..@................................5..@............................................text...^........................... ..`.rdata..\...........................@..@.data...............................@....rsrc...............................@..@.reloc..4?...`...@..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WPS.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	3027728
Entropy (8bit):	7.856503406318228
Encrypted:	false
SSDEEP:	49152:sejRVM654Suz/Debm7vpElDBc4uN+C+LHseGi1pm2PfLwUA0EUEiXDSWqf16yag5:sejRVMDhe6yH1ugfHseGKtPDw50E1iTe
MD5:	B52BA2B99108C496389AE5BB81FA6537
SHA1:	9073D8C4A1968BE24357862015519F2AFECD833A
SHA-256:	C6AC7D9ADD40B913112B265D4F366D9EF80BBD711049DB085FC750FCAD4E14D8
SHA-512:	6637506EE80D359E729E0011B97E8D827E14356393193247F502B7FCFBBCA249DC045B8ACFE4B31CE462468F421DC5D9A4E31183BEDB66C45A9AA43C01F81397
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......q...5...5...5...n.......n........a/.<......&....../...n...4...n...4..........n.......n...6...5... ...........5...V...............4...5...7.......4...Rich5...........PE..L.....dc.........................,..ZW...,..`W...@..........................0Z......s....@.................................T-Z......`W.T.............-..H....Z..............................\W......\W.....................$PD.@...................UPX0......,.............................UPX1.........,....................@....rsrc........`W....................@......................................................................................................................................................................................................................................................................................................................................3.08.UPX!....

C:\Users\user\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_dpv3.data

Download File

Process:	C:\Users\user\AppData\Roaming\WPS.exe
File Type:	data
Category:	modified
Size (bytes):	522
Entropy (8bit):	3.4213603631412406
Encrypted:	false
SSDEEP:	12:Dv3L/LOWMzgvWeqTQulhUbvfMVoK9aflRpZ/LOWMP0Ljt/LOWMfl:DTLOW2gOtTbhUbXMVoGabPLOWMcdLOWk
MD5:	ACE1930668BA1710863B78C8B3031002
SHA1:	17836DB4A389289D727AF7C55B9B70322CC03DFB
SHA-256:	EEEC360BDC1269555038AE09F7B716C8E39B5A99BD7781BF35D0A5D66E33765F
SHA-512:	5D11E50AE02DD12A3BE3CD1F2FA4589A1AE1D0C17A6AEFE06D458AF3844D3A8390D638553B62A583E568B0DAE788AB65391498EBCD47FE34EA6349F1C0A26F8E
Malicious:	false
Preview:	{.".u.p.l.o.a.d.S.t.r.a.t.e.g.y.".:.{.".v.e.r.s.i.o.n.".:.1.5.9.0.1.3.8.0.0.0.0.0.0.,.".t.r.a.n.s.p.o.r.t.C.o.n.t.r.o.l.".:.{.".s.p.l.i.t.S.i.z.e.".:.5.0.,.".g.z.i.p.S.i.z.e.".:.1.0.}.,.".u.p.l.o.a.d.C.o.n.d.i.t.i.o.n.s.".:.{.".t.i.m.e.I.n.t.e.r.v.a.l.".:.2.,.".c.u.m.u.l.a.t.i.v.e.".:.3.0.}.}.,.".s.e.n.d.U.r.l.s.".:.{.".v.e.r.s.i.o.n.".:.1.5.9.0.1.3.8.0.0.0.0.0.0.,.".u.r.l.s.".:.".(.h.t.t.p.:././.s.h.u.c.-.p.c.-.s.n.o.w...k.s.o.r.d...c.o.m.).".}.,.".e.v.e.n.t.s.".:.{.".v.e.r.s.i.o.n.".:.1.5.9.0.1.3.8.0.0.0.0.0.0.}.}.

C:\Users\user\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_eventv3.db

Download File

Process:	C:\Users\user\AppData\Roaming\WPS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3034001, file counter 6, database pages 4, cookie 0x2, schema 4, UTF-16 little endian, version-valid-for 6
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9290823193781924
Encrypted:	false
SSDEEP:	48:TYbZiQGWIxBjv/CkSrVzVBhx5Jm/LbVjIBjvgstMIn:cZAjMvhw//VjI14sD
MD5:	ACB2A84B8C114D13C0DA20432450A354
SHA1:	F0F4CB153E9AA9C6B46C9A5917A7186666F021C4
SHA-256:	AEB34F1B898BD95CA365EB8E482003F368A3896641337AAB9D4F0A2A7E3F8B01
SHA-512:	38ECA166A1C31198DAA59FB4A5C4AF7B162C97808D6B30E302E7545C59BFA10B6559EDDC059FE218705B9828DF66CA45ADB9C6BE9CF13B79BC127B0675CE8C4B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.......q......q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\kingsoft\wps\dcsdk\dcsdk_eventv3.db-journal

Download File

Process:	C:\Users\user\AppData\Roaming\WPS.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.6611159625904791
Encrypted:	false
SSDEEP:	12:7+tCDft0wNYDR/m34PnqLW24TgmgZkHhTy9Vb+ahgGXh9gRKe2PZkH+GwxQ4AW29:7+t+t0YAI4PqLh+bVChA+G63s
MD5:	5887CDFBEE32CB241F7B69DB650A8B82
SHA1:	F37766FA20ED55247D3234FFAA076DFF9357F834
SHA-256:	C21338DFF0F284FF766CE772681E8AE09942FDB1554D76E1770502C728F30466
SHA-512:	72721B743EF04B758994D8EF8453D0BBAD171E66901BACD209AFB25A8273A6F819CE2A2DDF918147F86AAF479A724927EFC0E9DD2D3A5C2B81F78EB10AD2F905
Malicious:	false
Preview:	.... .c.......)...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[..[..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\5559f9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {7DD8A22E-1308-45B2-86D0-5CB5038DFF9C}, Number of Words: 2, Subject: WPS Office v76.23.66, Author: v76.23.66, Name of Creating Application: WPS Office v76.23.66, Template: ;2052, Comments: WPS Office v76.23.66 , Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	9958912
Entropy (8bit):	7.744960621162115
Encrypted:	false
SSDEEP:	196608:nWxLkNZONFiVDfWpugrukEa3bwQLWnhLQusRQR7p+2+E:nELkNZONFMUFruxoNazsRO7pJt
MD5:	8B1B9AF08BC62E4608D21B5568C0A581
SHA1:	ACC808ACCBB6897DA328A1DEF679B42E198BF9E0
SHA-256:	4BF33D5531FE319BED3D1550608DED652EF6B52437B6CC94D47A0D388F5BB03B
SHA-512:	9C03511CCC5C4F1EE386A61E91F9AFADC7310D1798A2BA7D233A308FA73DFA260A868C4E30EFD92B3259406F645FC50E0449B89AEAB8827D32C4C725DD2F971F
Malicious:	false
Preview:	......................>...........................................Z...........K.......h.......9...:...;...<...=...>...K...L...M...N...O...P...Q.......................................................................L...M...N...O...P...Q...R...S...T...U...V...W....................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...............................'...:........................................................................................... ...!..."...#...$...%...&...3...(...8......+...,...-......./...0...1...2.......4...5...6...7...;...9...@...C...<...=...>...?...J...A...B.......D...E...F...G...H...I...d...e.......M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI5BCE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788480
Entropy (8bit):	6.397986909438471
Encrypted:	false
SSDEEP:	12288:DVMjEMXcOyXksIR18ytVt6f5ZORD1OUMUSMUufGg0L56OzpUoCj1CKgvcLjTAx:D6jEM0C25ZORULUDtsdduBjgvcLjTAx
MD5:	356FC2C181CC37E3F8AE4D6B855EBFCB
SHA1:	2EAD1E69F14099AE33A3216A9312C88007B73CD1
SHA-256:	C92B2D9623F19F8ACFEAC5FD894346515631EBB590E68F22C40A35FBACBEF03C
SHA-512:	74EA73D3206BA1C6F1963CAA4866589FE86636F68815C74733644AD6C4913DE3F1399770F6095A48C9D94A7D934072D8D8B409A393DE644265F6E456455DCEBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Z+..;E..;E..;E..IF..;E..I@.y;E..NA..;E..NF..;E..N@..;E..IA..;E..IC..;E..ID..;E..;D..:E.mNL..;E.mNE..;E.mN...;E..;..;E.mNG..;E.Rich.;E.........................PE..L....<.a.........."!.........................................................@............@..........................{.......}.......P.......................`..D....`..p...................@a......x`..@............................................text............................... ..`.rdata..p...........................@..@.data................x..............@....rsrc........P......................@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5C5C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5C7C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5D0A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5D97.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919520
Entropy (8bit):	6.451406895673526
Encrypted:	false
SSDEEP:	24576:rx90VXSK4fSa6HXr1iWn8Zlv2x4ntHurpllQ6a:Nq4Fb6HXr1iWnYs4ntHurpllQ6a
MD5:	6189CDCB92AB9DDBFFD95FACD0B631FA
SHA1:	B74C72CEFCB5808E2C9AE4BA976FA916BA57190D
SHA-256:	519F7AC72BEBA9D5D7DCF71FCAC15546F5CFD3BCFC37A5129E63B4E0BE91A783
SHA-512:	EE9CE27628E7A07849CD9717609688CA4229D47579B69E3D3B5B2E7C2433369DE9557EF6A13FA59964F57FB213CD8CA205B35F5791EA126BDE5A4E00F6A11CAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O...!S..!S..!S[."R..!S[.$R=.!S.%R..!S."R..!S.$R..!S[.%R..!S[. R..!S.. S..!S3.(R..!S3.!R..!S3..S..!S..S..!S3.#R..!SRich..!S........................PE..L...a<.a.........."!.....X...................p...............................@.......\|....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6950.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788480
Entropy (8bit):	6.397986909438471
Encrypted:	false
SSDEEP:	12288:DVMjEMXcOyXksIR18ytVt6f5ZORD1OUMUSMUufGg0L56OzpUoCj1CKgvcLjTAx:D6jEM0C25ZORULUDtsdduBjgvcLjTAx
MD5:	356FC2C181CC37E3F8AE4D6B855EBFCB
SHA1:	2EAD1E69F14099AE33A3216A9312C88007B73CD1
SHA-256:	C92B2D9623F19F8ACFEAC5FD894346515631EBB590E68F22C40A35FBACBEF03C
SHA-512:	74EA73D3206BA1C6F1963CAA4866589FE86636F68815C74733644AD6C4913DE3F1399770F6095A48C9D94A7D934072D8D8B409A393DE644265F6E456455DCEBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Z+..;E..;E..;E..IF..;E..I@.y;E..NA..;E..NF..;E..N@..;E..IA..;E..IC..;E..ID..;E..;D..:E.mNL..;E.mNE..;E.mN...;E..;..;E.mNG..;E.Rich.;E.........................PE..L....<.a.........."!.........................................................@............@..........................{.......}.......P.......................`..D....`..p...................@a......x`..@............................................text............................... ..`.rdata..p...........................@..@.data................x..............@....rsrc........P......................@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6990.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788480
Entropy (8bit):	6.397986909438471
Encrypted:	false
SSDEEP:	12288:DVMjEMXcOyXksIR18ytVt6f5ZORD1OUMUSMUufGg0L56OzpUoCj1CKgvcLjTAx:D6jEM0C25ZORULUDtsdduBjgvcLjTAx
MD5:	356FC2C181CC37E3F8AE4D6B855EBFCB
SHA1:	2EAD1E69F14099AE33A3216A9312C88007B73CD1
SHA-256:	C92B2D9623F19F8ACFEAC5FD894346515631EBB590E68F22C40A35FBACBEF03C
SHA-512:	74EA73D3206BA1C6F1963CAA4866589FE86636F68815C74733644AD6C4913DE3F1399770F6095A48C9D94A7D934072D8D8B409A393DE644265F6E456455DCEBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Z+..;E..;E..;E..IF..;E..I@.y;E..NA..;E..NF..;E..N@..;E..IA..;E..IC..;E..ID..;E..;D..:E.mNL..;E.mNE..;E.mN...;E..;..;E.mNG..;E.Rich.;E.........................PE..L....<.a.........."!.........................................................@............@..........................{.......}.......P.......................`..D....`..p...................@a......x`..@............................................text............................... ..`.rdata..p...........................@..@.data................x..............@....rsrc........P......................@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6A9A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6ABB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6B0A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788480
Entropy (8bit):	6.397986909438471
Encrypted:	false
SSDEEP:	12288:DVMjEMXcOyXksIR18ytVt6f5ZORD1OUMUSMUufGg0L56OzpUoCj1CKgvcLjTAx:D6jEM0C25ZORULUDtsdduBjgvcLjTAx
MD5:	356FC2C181CC37E3F8AE4D6B855EBFCB
SHA1:	2EAD1E69F14099AE33A3216A9312C88007B73CD1
SHA-256:	C92B2D9623F19F8ACFEAC5FD894346515631EBB590E68F22C40A35FBACBEF03C
SHA-512:	74EA73D3206BA1C6F1963CAA4866589FE86636F68815C74733644AD6C4913DE3F1399770F6095A48C9D94A7D934072D8D8B409A393DE644265F6E456455DCEBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Z+..;E..;E..;E..IF..;E..I@.y;E..NA..;E..NF..;E..N@..;E..IA..;E..IC..;E..ID..;E..;D..:E.mNL..;E.mNE..;E.mN...;E..;..;E.mNG..;E.Rich.;E.........................PE..L....<.a.........."!.........................................................@............@..........................{.......}.......P.......................`..D....`..p...................@a......x`..@............................................text............................... ..`.rdata..p...........................@..@.data................x..............@....rsrc........P......................@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6BB7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	772429
Entropy (8bit):	6.409962775710157
Encrypted:	false
SSDEEP:	12288:caHRuEs3Xmm9DZE+aHRuEs3Xmm9DZEUaHRuEs3Xmm9DZE8aHRuEs3Xmm9DZEY:c25snmmtZv25snmmtZz25snmmtZ925sV
MD5:	601A1BCE3BA81AE3DF321DF843C7178F
SHA1:	1F70DF73D53CA440E8FE223DE92B1090D99C7B19
SHA-256:	7F600F2BD1438FA7B38B15AF306D97A307E4AF76476A96615FC42D724A07C0A0
SHA-512:	79228FF19964E34AB78E81E193038E724261B2B96D729672C4EDD71C642B9B44540EF40BFA0FA20FF9D6B10B01D52BE369ECD261D6F5EFB7C3F262A57CBB6F15
Malicious:	false
Preview:	...@IXOS.@.....@FY.X.@.....@.....@.....@.....@.....@......&.{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}..WPS Office v76.23.66).WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi.@.....@B..L.@.....@........&.{7DD8A22E-1308-45B2-86D0-5CB5038DFF9C}.....@.....@.....@.....@.......@.....@.....@.......@......WPS Office v76.23.66......Rollback...V.n.d\O:.....RollbackCleanup.. Rd..Y.N.e.N...e.N:. .[.1.]. ....@.......@........ProcessComponents...f.e.~.N.l.Qh....@.....@.....@.]....&.{A19BE9EC-E940-4615-A9BA-832DC870C667}J.02:\Software\v76.23.66\{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}\AI_IA_ENABLE.@.......@.....@.....@........AI_RollbackTasks2...V.n,g0W...{:g.N.v.N.R...R...N.R.T:. .[.1.]. .J...AI_RollbackTasks2.@.-........MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a...

C:\Windows\Installer\MSI6BB8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.4059654303545885
Encrypted:	false
SSDEEP:	3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
MD5:	F11E8EC00DFD2D1344D8A222E65FEA09
SHA1:	235ED90CC729C50EB6B8A36EBCD2CF044A2D8B20
SHA-256:	775037D6D7DE214796F2F5850440257AE7F04952B73538DA2B55DB45F3B26E93
SHA-512:	6163DD8FD18B4520D7FDA0986A80F2E424FE55F5D65D67F5A3519A366E53049F902A08164EA5669476100B71BB2F0C085327B7C362174CB7A051D268F10872D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6C74.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.4059654303545885
Encrypted:	false
SSDEEP:	3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
MD5:	F11E8EC00DFD2D1344D8A222E65FEA09
SHA1:	235ED90CC729C50EB6B8A36EBCD2CF044A2D8B20
SHA-256:	775037D6D7DE214796F2F5850440257AE7F04952B73538DA2B55DB45F3B26E93
SHA-512:	6163DD8FD18B4520D7FDA0986A80F2E424FE55F5D65D67F5A3519A366E53049F902A08164EA5669476100B71BB2F0C085327B7C362174CB7A051D268F10872D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6CD3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.4059654303545885
Encrypted:	false
SSDEEP:	3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
MD5:	F11E8EC00DFD2D1344D8A222E65FEA09
SHA1:	235ED90CC729C50EB6B8A36EBCD2CF044A2D8B20
SHA-256:	775037D6D7DE214796F2F5850440257AE7F04952B73538DA2B55DB45F3B26E93
SHA-512:	6163DD8FD18B4520D7FDA0986A80F2E424FE55F5D65D67F5A3519A366E53049F902A08164EA5669476100B71BB2F0C085327B7C362174CB7A051D268F10872D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI704E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI706F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI70BE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	788480
Entropy (8bit):	6.397986909438471
Encrypted:	false
SSDEEP:	12288:DVMjEMXcOyXksIR18ytVt6f5ZORD1OUMUSMUufGg0L56OzpUoCj1CKgvcLjTAx:D6jEM0C25ZORULUDtsdduBjgvcLjTAx
MD5:	356FC2C181CC37E3F8AE4D6B855EBFCB
SHA1:	2EAD1E69F14099AE33A3216A9312C88007B73CD1
SHA-256:	C92B2D9623F19F8ACFEAC5FD894346515631EBB590E68F22C40A35FBACBEF03C
SHA-512:	74EA73D3206BA1C6F1963CAA4866589FE86636F68815C74733644AD6C4913DE3F1399770F6095A48C9D94A7D934072D8D8B409A393DE644265F6E456455DCEBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........Z+..;E..;E..;E..IF..;E..I@.y;E..NA..;E..NF..;E..N@..;E..IA..;E..IC..;E..ID..;E..;D..:E.mNL..;E.mNE..;E.mN...;E..;..;E.mNG..;E.Rich.;E.........................PE..L....<.a.........."!.........................................................@............@..........................{.......}.......P.......................`..D....`..p...................@a......x`..@............................................text............................... ..`.rdata..p...........................@..@.data................x..............@....rsrc........P......................@..@.reloc..D....`.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{0643F5DB-9DB9-46E7-9FAB-792BF97FAEF8}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1805592894082801
Encrypted:	false
SSDEEP:	12:JSbX72FjbiAGiLIlHVRpsh/7777777777777777777777777vDHFaCb9oe3LxSC3:J0QI58Bn3LZjaF
MD5:	3C5AB16FDAF099173D434F6D8063C1D6
SHA1:	99FE5CE5CF1E710EF21DA717EDC87AC7074667A1
SHA-256:	A980BA63489756B901AC99A8D5E6217B89D601F348D92252C19730949B14B462
SHA-512:	D7AEBD8C0D0074FDED34CBDE86CFD9CCD50D5AD9B604ECDAAC9FBA9EB9EB69040CE14D899E77686CE2FF12FE2C59D1CAE8DA6F04E536AEF7A73BF66CAC88B944
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8486500754464816
Encrypted:	false
SSDEEP:	48:p8PhQuRc06WXJCFT5NVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xBxZ:khQ15FTZL6RCJco2WG3
MD5:	FF73FCF5E6DCE090A6EC0839B4FFAD06
SHA1:	622DDBA0F89575F1180B3DE7B2926B4F57198102
SHA-256:	2A16BEEC6B0382760316C6D4E58D42A92B36E6866B2712670A8B16B7DAE13A40
SHA-512:	79B80B4E7A4CBBBFEF8AB9A0A12AA6A4831E8F6B9F51E8B14A0F28A9F040488CFCEDA51C8D6587F164B50B84DD814F3AB80086A9F95E1768DA7FEAF53E55D8C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375170691508401
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauV:zTtbmkExhMJCIpErs
MD5:	E59A866CF5982A97981B2B46D6A9EBBD
SHA1:	C3DE0CF52D878E55CEF411CC70E3F802D590BF70
SHA-256:	3C67360EE3EB588FE4D10CEA2C678EA4453F923269E6967F565B0C3831860449
SHA-512:	CAF961B815C6955DB600277CCDA1E33E3C50900A2077ADA1A8B6E9D5A42E1D81987FE99843290F165217760DC6466B3FC43270004E18932144ADD932A5775A73
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF02599C23F5C05C38.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF350EC17120BF7F1F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2106746195239575
Encrypted:	false
SSDEEP:	48:56TYuAO+CFXJTT55UVyPVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xp:mYCrT38WL6RCJco2WG3
MD5:	FE89B35EF34F6976E13A6EC965C238C7
SHA1:	7CC6AFFF64CFF35A1AD906497F651E83A90EEF74
SHA-256:	5D1C81B8B4B2AF341D5379B85DC318BCAC8C8817689630317A4A18A1463067A6
SHA-512:	8A960E1886D77E674A04FF46B91E117636B3E2B3B558B273C4BAB9AAC246F4413F72948E34B8357CD45DFAEE280C17F8DDFD32697E5CDF235E8B79D79F1216E1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF43B0B488D20CE934.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8486500754464816
Encrypted:	false
SSDEEP:	48:p8PhQuRc06WXJCFT5NVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xBxZ:khQ15FTZL6RCJco2WG3
MD5:	FF73FCF5E6DCE090A6EC0839B4FFAD06
SHA1:	622DDBA0F89575F1180B3DE7B2926B4F57198102
SHA-256:	2A16BEEC6B0382760316C6D4E58D42A92B36E6866B2712670A8B16B7DAE13A40
SHA-512:	79B80B4E7A4CBBBFEF8AB9A0A12AA6A4831E8F6B9F51E8B14A0F28A9F040488CFCEDA51C8D6587F164B50B84DD814F3AB80086A9F95E1768DA7FEAF53E55D8C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF51C97CFE163B1BA7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF53F1EB06D587FA2C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3078649027305127
Encrypted:	false
SSDEEP:	48:pV6fT4dRe6xSkdRe6mdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xBxYxMxT:Dv6RCJco2WGK
MD5:	9BB81113866A52E68C4504383C3DCEB9
SHA1:	269AA5ED651A385DF9D775F683A05FF177ECBE2A
SHA-256:	2C842CCA47588F31C4DEEF813BD0D5E2C49E05AADC72001CB7E1A64BA380DD54
SHA-512:	81412FFC1CB1370350208F3FC5367FCF349ADADDF21BF4E749F4580A23638B175AA40A86BA82DB8D699922C2B18393BE4E8C9E495805C72344DA53400130255A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF59631083F4F8E0E6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2106746195239575
Encrypted:	false
SSDEEP:	48:56TYuAO+CFXJTT55UVyPVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xp:mYCrT38WL6RCJco2WG3
MD5:	FE89B35EF34F6976E13A6EC965C238C7
SHA1:	7CC6AFFF64CFF35A1AD906497F651E83A90EEF74
SHA-256:	5D1C81B8B4B2AF341D5379B85DC318BCAC8C8817689630317A4A18A1463067A6
SHA-512:	8A960E1886D77E674A04FF46B91E117636B3E2B3B558B273C4BAB9AAC246F4413F72948E34B8357CD45DFAEE280C17F8DDFD32697E5CDF235E8B79D79F1216E1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6D36BA3FA78CBFB7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8362F5648321C79E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08329931249819422
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOaCb3Y0IDe30OtDSCjgEyVky6lt1:2F0i8n0itFzDHFaCb9oe3LxSCjXH
MD5:	DAB6BEF98AFA2FF655F3F08FC3CF4A8E
SHA1:	B235BE331B587A359F0D9538C97E4C84CDD1E4B6
SHA-256:	AA952B48D218A9384DD2E5920EE9840C53A81446A355C7CE49ACF0D7FBEAFEF4
SHA-512:	6CD3A0747668C0E4FB40EB04930B04CE6E4FB9DBDF277619D5A2AF128F8EF83860868A3B2349EA8C25651CF3455002237C13F14B90F4B24A5F95338101CEB1BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAB875B3911B284E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8486500754464816
Encrypted:	false
SSDEEP:	48:p8PhQuRc06WXJCFT5NVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xBxZ:khQ15FTZL6RCJco2WG3
MD5:	FF73FCF5E6DCE090A6EC0839B4FFAD06
SHA1:	622DDBA0F89575F1180B3DE7B2926B4F57198102
SHA-256:	2A16BEEC6B0382760316C6D4E58D42A92B36E6866B2712670A8B16B7DAE13A40
SHA-512:	79B80B4E7A4CBBBFEF8AB9A0A12AA6A4831E8F6B9F51E8B14A0F28A9F040488CFCEDA51C8D6587F164B50B84DD814F3AB80086A9F95E1768DA7FEAF53E55D8C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFECD0717D195AB181.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF3CC3071C2404D84.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2106746195239575
Encrypted:	false
SSDEEP:	48:56TYuAO+CFXJTT55UVyPVvgrdRe68SkdRe6PAEkrCyh6Moe8xfoHswXGcp4ru2xp:mYCrT38WL6RCJco2WG3
MD5:	FE89B35EF34F6976E13A6EC965C238C7
SHA1:	7CC6AFFF64CFF35A1AD906497F651E83A90EEF74
SHA-256:	5D1C81B8B4B2AF341D5379B85DC318BCAC8C8817689630317A4A18A1463067A6
SHA-512:	8A960E1886D77E674A04FF46B91E117636B3E2B3B558B273C4BAB9AAC246F4413F72948E34B8357CD45DFAEE280C17F8DDFD32697E5CDF235E8B79D79F1216E1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF702C42A6FA5A306.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.650608324205336
Encrypted:	false
SSDEEP:	3:8nQtI2Y1AnNTS/l/l8lLn:8QCGNT2qLn
MD5:	400347A0483E28FF65A605F8331A6D92
SHA1:	07139A455E84A8F757D4E534B3BAB4A55F2BAE67
SHA-256:	8F4EBE2894E669D01FF5ABC3BA842670F2D6C7E075EEFC13E6E25DF62DCCD9DA
SHA-512:	E412DCCB8520D21E9EA2FFA5D6802740F25CA6411108DB5859B23E4B0FF9B08FCD64B36AD88B8D68C6995BC07A3D3C5126FFAA308B54BDA7E17402A650EAD8EB
Malicious:	false
Preview:	....5.6.2.2.5.8.....\MAILSLOT\NET\GETDC0FC33CA7.................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {7DD8A22E-1308-45B2-86D0-5CB5038DFF9C}, Number of Words: 2, Subject: WPS Office v76.23.66, Author: v76.23.66, Name of Creating Application: WPS Office v76.23.66, Template: ;2052, Comments: WPS Office v76.23.66 , Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.744960621162115
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi
File size:	9'958'912 bytes
MD5:	8b1b9af08bc62e4608d21b5568c0a581
SHA1:	acc808accbb6897da328a1def679b42e198bf9e0
SHA256:	4bf33d5531fe319bed3d1550608ded652ef6b52437b6cc94d47a0d388f5bb03b
SHA512:	9c03511ccc5c4f1ee386a61e91f9afadc7310d1798a2ba7d233a308fa73dfa260a868c4e30efd92b3259406f645fc50e0449b89aeab8827d32c4c725dd2f971f
SSDEEP:	196608:nWxLkNZONFiVDfWpugrukEa3bwQLWnhLQusRQR7p+2+E:nELkNZONFMUFruxoNazsRO7pJt
TLSH:	0CA6022671DAC636EB7F8630657ADB3A21BA7BE20BB150CB63C01D2A0E745C11275F17
File Content Preview:	........................>...........................................Z...........K.......h.......9...:...;...<...=...>...K...L...M...N...O...P...Q.......................................................................L...M...N...O...P...Q...R...S...T...U..

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/17/24-17:10:19.103117	TCP	2849814	ETPRO MALWARE TakeMyFile User-Agent	49733	80	192.168.2.4	54.224.49.0
07/17/24-17:10:19.103117	TCP	2849813	ETPRO MALWARE TakeMyFile Installer Checkin	49733	80	192.168.2.4	54.224.49.0

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-17T17:10:24.358485+0200	TCP	2840787	ETPRO HUNTING Request for config.json	49741	443	192.168.2.4	184.28.90.27
2024-07-17T17:10:19.276636+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49733	80	192.168.2.4	54.224.49.0
2024-07-17T17:10:19.276636+0200	TCP	2849813	ETPRO ADWARE_PUP TakeMyFile Installer Checkin	49733	80	192.168.2.4	54.224.49.0
2024-07-17T17:10:19.276636+0200	TCP	2848122	ETPRO HUNTING Windows System Information in UA	49733	80	192.168.2.4	54.224.49.0

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2024 17:10:12.725332022 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:12.730345964 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:12.731245995 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:12.734359980 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:12.734359980 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:12.741225958 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:12.741241932 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.256496906 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.257452965 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.272914886 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.272914886 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.278068066 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.279211998 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.446481943 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.447248936 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.472491980 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.472546101 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.477437973 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.478509903 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.648201942 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.648334026 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.680234909 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.680234909 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.685250998 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.685359955 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.793901920 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.794111967 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.797785044 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.797904968 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.802784920 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.803215981 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.963952065 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.964050055 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.965502024 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.965598106 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:13.970526934 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:13.970591068 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.080120087 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.080293894 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.081881046 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.082060099 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.089540005 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.089978933 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.198117971 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.198255062 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.199641943 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.199641943 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.205864906 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.314155102 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.314466953 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.315696001 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.315696955 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.321434021 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.321444035 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.494215012 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.494328976 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.496368885 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.496368885 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.501323938 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.501472950 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.677228928 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.677294970 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.679240942 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.679240942 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.684246063 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.799758911 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.799830914 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.802352905 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.802448988 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:14.808312893 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.808533907 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.969542980 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:14.972325087 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.255584955 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.255584955 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.256572962 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.256839037 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.260426044 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.261645079 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.261662960 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.261722088 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.261760950 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.261950970 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.262120962 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.262140989 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.262140989 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.262474060 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:15.267801046 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.267838955 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.267857075 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.267940998 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:15.467645884 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.467719078 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.470438004 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.470438004 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.475282907 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.475358963 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.583059072 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.583404064 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.585206985 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.585206985 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.590306997 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.590353966 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.697824001 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.697943926 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.699244976 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.699244976 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.704292059 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.704317093 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.813503027 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.813663960 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.816407919 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.816407919 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.821419001 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.821430922 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.937577963 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.937911034 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.940515041 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.940515041 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:15.955391884 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:15.955403090 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.125011921 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.125071049 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.126827955 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.126827955 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.133125067 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.133140087 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.210469961 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.210740089 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.210784912 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.215970039 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.216569901 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.220155954 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.220415115 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.220415115 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.225317001 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.225332022 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.244419098 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.244647026 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.245954990 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.245954990 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.246526957 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:16.250931978 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.250976086 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.251451969 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:16.251527071 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:16.251719952 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:16.251751900 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:16.256680965 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:16.256694078 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:16.415045977 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.415550947 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.416790009 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.416790009 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.421659946 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.421739101 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.557754040 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.558199883 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.558199883 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.563029051 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.563205004 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.585025072 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.585079908 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.586383104 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.586383104 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.591217995 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.591417074 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.752386093 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.752510071 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.753545046 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.753545046 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.758455992 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.819785118 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.820014000 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.820050955 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:16.824791908 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.824944019 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:16.866070032 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.866126060 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.867706060 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.867706060 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.872646093 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.980597019 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.980798960 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.982928991 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.982928991 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:16.987755060 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:16.987807035 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.148133039 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.152513027 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.155025005 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.155025005 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.159953117 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.171869040 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.172063112 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.172063112 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.176798105 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.177016020 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.251981974 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:17.267460108 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.267640114 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.268661976 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.268661976 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.273432016 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.273514032 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.295739889 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:17.382500887 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:17.436412096 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:17.450845957 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.451008081 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.451546907 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.453701019 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.453701019 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.456121922 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.456166983 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.458760023 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.460912943 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.461060047 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.512062073 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.512248039 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.512303114 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.517143011 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.517180920 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.566576004 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.572508097 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.590986967 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.591053963 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.596127033 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.704190969 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.704492092 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.705941916 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.706039906 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.712711096 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.866533995 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.866656065 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.868762016 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.869271040 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:17.872185946 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.874121904 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.874829054 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.874829054 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:17.881757021 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:17.883701086 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:17.883760929 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.040452003 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.040504932 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.041973114 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.042223930 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.053914070 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.094398022 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.094563961 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.094619989 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.101542950 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.101553917 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.162694931 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.162785053 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.163830042 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.164518118 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.169343948 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.216381073 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.216553926 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.216594934 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.221632004 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.221662998 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.294300079 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.294482946 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.295819044 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.296387911 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.301182032 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.411706924 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.411773920 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.412949085 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.412980080 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.418721914 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.446715117 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.446871042 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.446952105 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.451771021 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.451811075 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.530514956 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.530612946 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.531809092 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.531861067 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.536787987 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.559844971 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.560023069 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.560023069 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.565016031 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.565170050 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.646619081 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.646675110 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.648217916 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.648217916 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.653135061 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.760740042 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.760813951 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.761914968 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.761993885 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.766933918 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.766958952 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.778928041 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.779118061 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.779205084 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:18.784450054 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.784475088 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:18.933803082 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.934123993 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.934974909 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.935018063 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:18.940332890 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:18.941036940 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:19.102085114 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:19.102220058 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:19.103116989 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:19.103187084 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:19.108032942 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:19.108285904 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:19.111368895 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:19.111541986 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:19.111592054 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:19.116370916 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:19.116410017 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:19.172398090 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:19.217693090 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:19.276467085 CEST	80	49733	54.224.49.0	192.168.2.4
Jul 17, 2024 17:10:19.276635885 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:19.522341013 CEST	49733	80	192.168.2.4	54.224.49.0
Jul 17, 2024 17:10:19.721704960 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:10:19.764514923 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:10:24.186827898 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:24.186933041 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:24.187036991 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:24.189071894 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:24.189112902 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.540309906 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.573703051 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:25.573739052 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.577426910 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.577656031 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:25.588572025 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:25.588675022 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:25.588687897 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.588713884 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.639477968 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:25.639497995 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:25.686358929 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:26.854310036 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:26.854388952 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:26.854439974 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:26.854654074 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:26.854654074 CEST	49743	443	192.168.2.4	119.3.210.249
Jul 17, 2024 17:10:26.854676962 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:26.854686975 CEST	443	49743	119.3.210.249	192.168.2.4
Jul 17, 2024 17:10:28.252994061 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:10:28.253458977 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:28.327682018 CEST	49736	80	192.168.2.4	110.249.194.76
Jul 17, 2024 17:10:28.334990978 CEST	80	49736	110.249.194.76	192.168.2.4
Jul 17, 2024 17:12:04.642868042 CEST	49735	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:12:04.642868996 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:12:04.648251057 CEST	80	49734	116.181.3.214	192.168.2.4
Jul 17, 2024 17:12:04.648327112 CEST	49734	80	192.168.2.4	116.181.3.214
Jul 17, 2024 17:12:04.649633884 CEST	80	49735	116.181.3.214	192.168.2.4
Jul 17, 2024 17:12:04.649710894 CEST	49735	80	192.168.2.4	116.181.3.214

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2024 17:10:12.698647022 CEST	50509	53	192.168.2.4	1.1.1.1
Jul 17, 2024 17:10:12.715121984 CEST	53	50509	1.1.1.1	192.168.2.4
Jul 17, 2024 17:10:14.644109964 CEST	56826	53	192.168.2.4	1.1.1.1
Jul 17, 2024 17:10:14.925374985 CEST	53	56826	1.1.1.1	192.168.2.4
Jul 17, 2024 17:10:16.234920979 CEST	65154	53	192.168.2.4	1.1.1.1
Jul 17, 2024 17:10:16.245639086 CEST	53	65154	1.1.1.1	192.168.2.4
Jul 17, 2024 17:10:24.164304018 CEST	53526	53	192.168.2.4	1.1.1.1
Jul 17, 2024 17:10:24.177015066 CEST	53	53526	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 17, 2024 17:10:12.698647022 CEST	192.168.2.4	1.1.1.1	0xe189	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:14.644109964 CEST	192.168.2.4	1.1.1.1	0xeca2	Standard query (0)	dw-online.ksosoft.com	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:16.234920979 CEST	192.168.2.4	1.1.1.1	0x3cf0	Standard query (0)	shuc-pc-snow.ksord.com	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:24.164304018 CEST	192.168.2.4	1.1.1.1	0xa1f9	Standard query (0)	downloader.wps.cn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 17, 2024 17:10:12.715121984 CEST	1.1.1.1	192.168.2.4	0xe189	No error (0)	collect.installeranalytics.com		54.224.49.0	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:12.715121984 CEST	1.1.1.1	192.168.2.4	0xe189	No error (0)	collect.installeranalytics.com		54.204.31.229	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:14.925374985 CEST	1.1.1.1	192.168.2.4	0xeca2	No error (0)	dw-online.ksosoft.com		116.181.3.214	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:16.245639086 CEST	1.1.1.1	192.168.2.4	0x3cf0	No error (0)	shuc-pc-snow.ksord.com		110.249.194.76	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:24.177015066 CEST	1.1.1.1	192.168.2.4	0xa1f9	No error (0)	downloader.wps.cn	klbv2.wpsdns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 17, 2024 17:10:24.177015066 CEST	1.1.1.1	192.168.2.4	0xa1f9	No error (0)	klbv2.wpsdns.com		119.3.210.249	A (IP address)	IN (0x0001)	false
Jul 17, 2024 17:10:24.177015066 CEST	1.1.1.1	192.168.2.4	0xa1f9	No error (0)	klbv2.wpsdns.com		139.9.135.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

downloader.wps.cn

collect.installeranalytics.com

dw-online.ksosoft.com

shuc-pc-snow.ksord.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	54.224.49.0	80	2896	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 17:10:12.734359980 CEST	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 168 Cache-Control: no-cache
Jul 17, 2024 17:10:12.734359980 CEST	168	OUT	Data Raw: 71 74 3d 35 35 39 39 38 31 32 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 76 3d 37 36 2e 32 33 2e 36 36 26 63 69 64 3d 37 Data Ascii: qt=5599812&t=lifecycle&lc=start&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:13.256496906 CEST	338	IN	HTTP/1.1 200 OK Cache-control: no-cache="set-cookie" Date: Wed, 17 Jul 2024 15:10:13 GMT Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366;PATH=/;MAX-AGE=600 X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:13.272914886 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:13.272914886 CEST	180	OUT	Data Raw: 71 74 3d 35 36 30 30 34 35 33 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 76 3d 37 36 Data Ascii: qt=5600453&t=property&lb=VersionNT&val=1000&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:13.446481943 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:13.472491980 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 182 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:13.472546101 CEST	182	OUT	Data Raw: 71 74 3d 35 36 30 30 36 35 36 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 36 34 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 76 3d Data Ascii: qt=5600656&t=property&lb=VersionNT64&val=1000&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:13.648201942 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:13.680234909 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:13.680234909 CEST	185	OUT	Data Raw: 71 74 3d 35 36 30 30 38 35 39 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 38 31 39 31 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 Data Ascii: qt=5600859&t=property&lb=PhysicalMemory&val=8191&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:13.793901920 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:13.797785044 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:13.797904968 CEST	181	OUT	Data Raw: 71 74 3d 35 36 30 30 39 38 34 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4d 73 69 26 76 61 6c 3d 35 2e 30 30 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 76 3d 37 Data Ascii: qt=5600984&t=property&lb=VersionMsi&val=5.00&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:13.963952065 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:13.965502024 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 175 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:13.965598106 CEST	175	OUT	Data Raw: 71 74 3d 35 36 30 31 31 34 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 55 49 4c 65 76 65 6c 26 76 61 6c 3d 33 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 76 3d 37 36 2e 32 33 2e 36 Data Ascii: qt=5601140&t=property&lb=UILevel&val=3&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:14.080120087 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.081881046 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.082060099 CEST	184	OUT	Data Raw: 71 74 3d 35 36 30 31 32 36 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 36 36 39 33 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 Data Ascii: qt=5601265&t=property&lb=VirtualMemory&val=6693&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:14.198117971 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.199641943 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.199641943 CEST	184	OUT	Data Raw: 71 74 3d 35 36 30 31 33 37 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 4d 73 69 4e 54 50 72 6f 64 75 63 74 54 79 70 65 26 76 61 6c 3d 31 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 Data Ascii: qt=5601375&t=property&lb=MsiNTProductType&val=1&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:14.314155102 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.315696001 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.315696955 CEST	184	OUT	Data Raw: 71 74 3d 35 36 30 31 35 30 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 53 65 72 76 69 63 65 50 61 63 6b 4c 65 76 65 6c 26 76 61 6c 3d 30 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 26 61 Data Ascii: qt=5601500&t=property&lb=ServicePackLevel&val=0&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:14.494215012 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.496368885 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 186 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.496368885 CEST	186	OUT	Data Raw: 71 74 3d 35 36 30 31 36 37 31 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 26 76 61 6c 3d 32 30 35 32 26 76 3d 33 26 61 69 64 3d 36 36 39 36 63 39 35 36 32 66 66 35 30 38 62 66 62 61 38 31 65 66 30 61 Data Ascii: qt=5601671&t=property&lb=ProductLanguage&val=2052&v=3&aid=6696c9562ff508bfba81ef0a&av=76.23.66&cid=700FE11B8D5DC060C5656D9D4D19B4AF9C9772F9&sid=%7B8AE698CD-4D24-4723-A62C-73BE1AFF81EE%7D
Jul 17, 2024 17:10:14.677228928 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.679240942 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 196 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.799758911 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:14.802352905 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:14.969542980 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.255584955 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 196 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:15.467645884 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.470438004 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:15.583059072 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.585206985 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:15.697824001 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.699244976 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 211 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:15.813503027 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.816407919 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 212 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:15.937577963 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:15.940515041 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 194 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.125011921 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.126827955 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.244419098 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.245954990 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 200 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.415045977 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.416790009 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.585025072 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.586383104 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.752386093 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.753545046 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.866070032 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.867706060 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 203 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:16.980597019 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:16 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:16.982928991 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 205 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.148133039 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.155025005 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 205 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.267460108 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.268661976 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.451008081 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.453701019 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.566576004 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.590986967 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.704190969 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.705941916 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 209 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:17.866533995 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:17.868762016 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 213 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.040452003 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:17 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.041973114 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.162694931 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.163830042 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.294300079 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.295819044 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 177 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.411706924 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.412949085 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.530514956 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.531809092 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.646619081 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.648217916 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 173 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.760740042 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.761914968 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:18.933803082 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:18 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:18.934974909 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 220 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:19.102085114 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:19 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 17, 2024 17:10:19.103116989 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 177 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Jul 17, 2024 17:10:19.276467085 CEST	122	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 15:10:19 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	116.181.3.214	80	7412	C:\Users\user\AppData\Roaming\WPS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 17:10:15.262120962 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 185 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:15.262474060 CEST	185	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","eventsVersion":0,"sdkType":"C++","sdkVersion":"2.8.16","sendUrlVersion":0,"transportControlVersion":0}
Jul 17, 2024 17:10:16.210469961 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:16 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:16.210740089 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:16.210784912 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:16.819785118 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:16 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:16.820014000 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:16.820050955 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:17.450845957 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:17 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:17.456121922 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:17.456166983 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:18.094398022 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:17 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:18.094563961 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:18.094619989 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:18.446715117 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:18 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:18.446871042 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:18.446952105 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:18.778928041 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:18 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:18.779118061 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:18.779205084 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:19.111368895 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:18 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:19.111541986 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:19.111592054 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:19.721704960 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:19 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	116.181.3.214	80	7412	C:\Users\user\AppData\Roaming\WPS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 17:10:15.262140989 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:15.262140989 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:16.220155954 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:16 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:16.220415115 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:16.220415115 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:16.557754040 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:16 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:16.558199883 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:16.558199883 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:17.171869040 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:17 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:17.172063112 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:17.172063112 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:17.512062073 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:17 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:17.512248039 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:17.512303114 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:17.872185946 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:17 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:17.874829054 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:17.874829054 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:18.216381073 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:18 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:18.216553926 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:18.216594934 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:18.559844971 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:18 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}
Jul 17, 2024 17:10:18.560023069 CEST	165	OUT	POST /api/dynamicParam/v3/app/6561882c644c3686 HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Content-Length: 120 Host: dw-online.ksosoft.com
Jul 17, 2024 17:10:18.560023069 CEST	120	OUT	Data Raw: 7b 22 61 70 70 54 6f 6b 65 6e 22 3a 22 36 35 36 31 38 38 32 63 36 34 34 63 33 36 38 36 22 2c 22 61 70 70 56 65 72 73 69 6f 6e 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 63 68 61 6e 6e 65 6c 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c Data Ascii: {"appToken":"6561882c644c3686","appVersion":"11.1.0.12919","channel":"12012.2019","sdkType":"C++","sdkVersion":"2.8.16"}
Jul 17, 2024 17:10:19.172398090 CEST	552	IN	HTTP/1.1 200 Server: CLOUD ELB 1.0.0 Date: Wed, 17 Jul 2024 15:10:19 GMT Content-Type: application/json Content-Length: 261 Connection: keep-alive Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers t: 1 sign: 0d126b605f98cf8ac543b74256d4e627 Data Raw: 7b 22 75 70 6c 6f 61 64 53 74 72 61 74 65 67 79 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 74 72 61 6e 73 70 6f 72 74 43 6f 6e 74 72 6f 6c 22 3a 7b 22 73 70 6c 69 74 53 69 7a 65 22 3a 35 30 2c 22 67 7a 69 70 53 69 7a 65 22 3a 31 30 7d 2c 22 75 70 6c 6f 61 64 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 7b 22 74 69 6d 65 49 6e 74 65 72 76 61 6c 22 3a 32 2c 22 63 75 6d 75 6c 61 74 69 76 65 22 3a 33 30 7d 7d 2c 22 73 65 6e 64 55 72 6c 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 2c 22 75 72 6c 73 22 3a 22 28 68 74 74 70 3a 2f 2f 73 68 75 63 2d 70 63 2d 73 6e 6f 77 2e 6b 73 6f 72 64 2e 63 6f 6d 29 22 7d 2c 22 65 76 65 6e 74 73 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 31 35 39 30 31 33 38 30 30 30 30 30 30 7d 7d Data Ascii: {"uploadStrategy":{"version":1590138000000,"transportControl":{"splitSize":50,"gzipSize":10},"uploadConditions":{"timeInterval":2,"cumulative":30}},"sendUrls":{"version":1590138000000,"urls":"(http://shuc-pc-snow.ksord.com)"},"events":{"version":1590138000000}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	110.249.194.76	80	7412	C:\Users\user\AppData\Roaming\WPS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 17:10:16.251719952 CEST	144	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json dw-protocol: 1.0 Content-Length: 889 Host: shuc-pc-snow.ksord.com
Jul 17, 2024 17:10:16.251751900 CEST	889	OUT	Data Raw: 46 64 6b 74 38 74 54 78 30 31 78 72 45 59 36 31 4a 4d 48 45 47 72 53 62 5a 33 6c 59 38 47 65 45 70 6b 4e 4e 52 5a 64 6e 6c 4a 76 36 61 55 42 52 32 48 6c 74 6d 48 74 79 78 6c 39 39 2f 6b 4b 47 56 42 43 48 67 63 32 2f 0a 4e 34 61 59 57 43 57 6f 72 Data Ascii: Fdkt8tTx01xrEY61JMHEGrSbZ3lY8GeEpkNNRZdnlJv6aUBR2HltmHtyxl99/kKGVBCHgc2/N4aYWCWorqqXFQdmc/4gA9CBJfN17/CavaMmVvQUCyRdGcz++0oeZkcjyc4ainlbLnCwjBM1c0BiDJRMMd2U0g0tcZDiLSUUi0hgbzHxS6x8Q7IvI653GZFPX0QxkTHt8DHzBRGa1CezLeXvzxVLRn6pcapPwogtUokbAU2A
Jul 17, 2024 17:10:17.251981974 CEST	71	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Connection: keep-alive
Jul 17, 2024 17:10:17.382500887 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	119.3.210.249	443	7412	C:\Users\user\AppData\Roaming\WPS.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 15:10:25 UTC	387	OUT	POST /api/v1/link HTTP/1.1 Host: downloader.wps.cn Accept: / Client-Type: loader-pc Client-Chan: 10.1.xxxx Client-Ver: 1.0.0 Client-Lang: zh Content-Type: application/json Authorization: WPS:yqW282sr:YzhiYWY3ZjA1NWE5MGNmOWY2YzUyYjgzNjMyMjczNDUyMmQ5ZjMwZA== Date: Wed, 17 Jul 2024 16:40:47 GMT Content-Md5: ZmUyMDdjYmZiOTFiZmIyMjQxOGZhNWNhZjU1ODgxZGY= Content-Length: 151
2024-07-17 15:10:25 UTC	151	OUT	Data Raw: 7b 22 6c 6f 61 64 65 72 5f 63 68 61 6e 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c 22 6c 6f 61 64 65 72 5f 6d 64 35 22 3a 22 62 35 32 62 61 32 62 39 39 31 30 38 63 34 39 36 33 38 39 61 65 35 62 62 38 31 66 61 36 35 33 37 22 2c 22 6c 6f 61 64 65 72 5f 76 65 72 22 3a 22 31 31 2e 31 2e 30 2e 31 32 39 31 39 22 2c 22 6f 73 5f 76 65 72 22 3a 22 31 30 2e 30 22 2c 22 70 5f 6d 6f 64 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 72 5f 69 64 22 3a 22 30 22 7d Data Ascii: {"loader_chan":"12012.2019","loader_md5":"b52ba2b99108c496389ae5bb81fa6537","loader_ver":"11.1.0.12919","os_ver":"10.0","p_mod":"installer","r_id":"0"}
2024-07-17 15:10:26 UTC	153	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 844 Connection: close Date: Wed, 17 Jul 2024 15:10:26 GMT X-KLB: 2
2024-07-17 15:10:26 UTC	844	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 73 75 63 63 65 73 73 22 2c 22 64 61 74 61 22 3a 7b 22 72 5f 69 64 22 3a 22 30 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 69 61 6c 2d 70 61 63 6b 61 67 65 2e 77 70 73 63 64 6e 2e 63 6e 2f 77 70 73 2f 64 6f 77 6e 6c 6f 61 64 2f 57 50 53 5f 53 65 74 75 70 5f 31 35 33 31 39 2e 65 78 65 22 2c 22 66 5f 73 69 7a 65 22 3a 32 33 36 39 34 35 35 30 34 2c 22 66 5f 6d 64 35 22 3a 22 32 34 32 34 62 65 64 31 62 32 63 62 39 34 39 64 64 62 33 38 66 37 32 66 33 35 32 61 31 62 37 37 22 2c 22 77 5f 76 65 72 22 3a 22 31 31 2e 31 2e 30 2e 31 35 33 31 39 22 2c 22 77 5f 63 68 61 6e 22 3a 22 31 32 30 31 32 2e 32 30 31 39 22 2c 22 69 5f 6f 70 74 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 6f 6d 70 61 74 69 62 6c Data Ascii: {"code":0,"msg":"success","data":{"r_id":"0","url":"https://official-package.wpscdn.cn/wps/download/WPS_Setup_15319.exe","f_size":236945504,"f_md5":"2424bed1b2cb949ddb38f72f352a1b77","w_ver":"11.1.0.15319","w_chan":"12012.2019","i_opt":[{"name":"compatibl

Target ID:	0
Start time:	11:10:05
Start date:	17/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi"
Imagebase:	0x7ff65d660000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:10:05
Start date:	17/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff65d660000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:10:06
Start date:	17/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding AF7A5A98FCE59EB21923DEC3642535A5
Imagebase:	0xbf0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:10:10
Start date:	17/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding FC7440F48901E81826ED2A23961C7067 E Global\MSI0000
Imagebase:	0xbf0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:10:11
Start date:	17/07/2024
Path:	C:\Windows\Installer\MSI704E.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI704E.tmp" /DontWait "C:\Users\user\AppData\Roaming\WPS.exe"
Imagebase:	0xa30000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:10:11
Start date:	17/07/2024
Path:	C:\Windows\Installer\MSI706F.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI706F.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
Imagebase:	0x170000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:10:12
Start date:	17/07/2024
Path:	C:\Users\user\AppData\Roaming\WPS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\WPS.exe"
Imagebase:	0xe0000
File size:	3'027'728 bytes
MD5 hash:	B52BA2B99108C496389AE5BB81FA6537
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:10:12
Start date:	17/07/2024
Path:	C:\ProgramData\Microsoft\MF\thelper.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Microsoft\MF\thelper.exe"
Imagebase:	0xf80000
File size:	231'896 bytes
MD5 hash:	17749F66292F190EF93652EB512C5AB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000007.00000002.1787100730.0000000001153000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000007.00000002.1787432909.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:10:12
Start date:	17/07/2024
Path:	C:\ProgramData\Microsoft\MF\thelper.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\Microsoft\MF\thelper.exe
Imagebase:	0xf80000
File size:	231'896 bytes
MD5 hash:	17749F66292F190EF93652EB512C5AB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000008.00000002.1788291853.00000000031E3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000008.00000002.1787680765.00000000018C7000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:10:12
Start date:	17/07/2024
Path:	C:\ProgramData\Microsoft\MF\thelper.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\Microsoft\MF\thelper.exe
Imagebase:	0xf80000
File size:	231'896 bytes
MD5 hash:	17749F66292F190EF93652EB512C5AB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000009.00000002.1784186616.0000000002CE3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000009.00000002.1783920751.0000000002C37000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:10:13
Start date:	17/07/2024
Path:	C:\Users\user\AppData\Local\thelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\thelper.exe"
Imagebase:	0x850000
File size:	231'896 bytes
MD5 hash:	17749F66292F190EF93652EB512C5AB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:10:13
Start date:	17/07/2024
Path:	C:\Users\user\AppData\Roaming\WPS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\WPS.exe" -upgradepower
Imagebase:	0xe0000
File size:	3'027'728 bytes
MD5 hash:	B52BA2B99108C496389AE5BB81FA6537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.5%
Total number of Nodes:	420
Total number of Limit Nodes:	11

Executed Functions

Function 00A34BA0 Relevance: 36.5, APIs: 24, Instructions: 502
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A357C0: GetCurrentProcess.KERNEL32(00000008,?,9666CEAE,?,-00000010), ref: 00A357D0
Part of subcall function 00A357C0: OpenProcessToken.ADVAPI32(00000000), ref: 00A357D7

CoInitialize.OLE32(00000000), ref: 00A34C15
CoCreateInstance.OLE32(00A772B0,00000000,00000004,00A85104,00000000,?), ref: 00A34C45
CoUninitialize.OLE32 ref: 00A35187
_com_issue_error.COMSUPP ref: 00A351B5

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: 7be05f67ce5bd2757ecfd6eede0780e0df8563027ab3d905b61f7f5f7954bd98
Instruction ID: fc80396bc7512e3358e9b0c8ce5e73e8e39459b6fecb58982238c7629b736c6a
Opcode Fuzzy Hash: 7be05f67ce5bd2757ecfd6eede0780e0df8563027ab3d905b61f7f5f7954bd98
Instruction Fuzzy Hash: 9C228D70E04388DFEB11DFB8CD48BADBBB4AF49304F248199E809EB291D7759A45CB51

Function 00A36A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A36AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00A36AD5
CloseHandle.KERNEL32(00000000), ref: 00A36AF5

Strings

S-1-5-18, xrefs: 00A36B69

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 02225aa51312519ee7889b01662db7618b2e705872e6cd70df36fda1a03ca21b
Instruction ID: 63e0014130d2c7eb2e6a6adfa95dbafcf5a93358f762c65c3a3834238b1098dd
Opcode Fuzzy Hash: 02225aa51312519ee7889b01662db7618b2e705872e6cd70df36fda1a03ca21b
Instruction Fuzzy Hash: D302AF70900659EFDF14DFA4C9557EEBBB5EF45354F18C658E802AB281EB30AE05CB90

Function 00A357C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,9666CEAE,?,-00000010), ref: 00A357D0
OpenProcessToken.ADVAPI32(00000000), ref: 00A357D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00A3580C
CloseHandle.KERNEL32(?), ref: 00A35822

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: dab2901b0cc05eade75243fbb4ebf3bec3b9addc71f214b6421aac5436e18490
Instruction ID: 664beb4b888a86a2ee3f604c78877bfafe619bf67d8ae6df32d9d09334dbd1ac
Opcode Fuzzy Hash: dab2901b0cc05eade75243fbb4ebf3bec3b9addc71f214b6421aac5436e18490
Instruction Fuzzy Hash: 51F01D74548301ABEB10DF64EC49BAE7BE8BB44700F508819F985C21A0D379965DDB63

Function 00A3CDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(9666CEAE,?,?,?,?,?,?,?,?,?,00A756D5,000000FF), ref: 00A3CDE8

Part of subcall function 00A31F80: LocalAlloc.KERNEL32(00000040,00000000,?,?,vector too long,00A34251,9666CEAE,00000000,?,00000000,?,?,?,00A74400,000000FF,?), ref: 00A31F9D

ExitProcess.KERNEL32 ref: 00A3CEB1

Part of subcall function 00A36600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00A3667E

Strings

Full command line:, xrefs: 00A3CE13

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: f6874bdd4143742b4dba705088de362a25a0170edeab1fda9c8759aa270beec4
Instruction ID: cb0239afba88e20d7b811a6d16efcb1bdafa60647be5cb074a0bd686827ebf0d
Opcode Fuzzy Hash: f6874bdd4143742b4dba705088de362a25a0170edeab1fda9c8759aa270beec4
Instruction Fuzzy Hash: 8C21F171D10214ABCB15FB70CE46BEE73B5AF44B50F148129F406AB292EF749B09CB91

Function 00A35E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00A35E18,9666CEAE,?), ref: 00A35EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00A35E18,9666CEAE,?), ref: 00A35EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00A35E18,9666CEAE,?), ref: 00A35F1A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 90fbf057d9c42089e0b9b1ba437c12e6403827ae39ff3af3a9a3918dc66c7879
Instruction ID: 8d3ee22d99b4092adf7138f4201fb273e5b4bab927c96babf4637e6cf53b8690
Opcode Fuzzy Hash: 90fbf057d9c42089e0b9b1ba437c12e6403827ae39ff3af3a9a3918dc66c7879
Instruction Fuzzy Hash: E3318D71A00605AFDB24CFA9CD45BAFFBF9FB44714F20852EF415A7280D7B5A9048BA0

Function 00A65BDC Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00A63841,?,00A6543A,?,00000000,?,00A56CE7,00000000,00A63841,00000000,?,?,?,00A6363B), ref: 00A65C0E

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 20b4931e765da03be203db3b81b36dda5f518cf80b4bd58ec35d5ebc74c928f1
Instruction ID: ed20ffb23a8979b1a2ad04ff878c6a72b2e81c74425e6ea32bdc4e3e4a684c9c
Opcode Fuzzy Hash: 20b4931e765da03be203db3b81b36dda5f518cf80b4bd58ec35d5ebc74c928f1
Instruction Fuzzy Hash: D5E06D31E15B219BD7312BB59E01B9E37BCAF917B1F150124FC66961E1DB20CC4186E5

Non-executed Functions

Function 00A352F0 Relevance: 52.9, APIs: 14, Strings: 16, Instructions: 402
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 00A3549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 00A3551D
ShellExecuteExW.SHELL32(?), ref: 00A35601
ShellExecuteExW.SHELL32(?), ref: 00A35637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00A3567C
GetProcAddress.KERNEL32(00000000), ref: 00A35685
AllowSetForegroundWindow.USER32(00000000), ref: 00A3568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00A356AB
GetProcAddress.KERNEL32(00000000), ref: 00A356AE
Sleep.KERNEL32(00000064,?,?,?,?,?,?), ref: 00A356CA
EnumWindows.USER32(00A35830,?), ref: 00A356DF
BringWindowToTop.USER32(00000000), ref: 00A356F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00A35711
GetExitCodeProcess.KERNEL32(?,?), ref: 00A3571B

Strings

Kernel32.dll, xrefs: 00A35677, 00A356A6
ShellExecuteInfo members:, xrefs: 00A35540
FilePath:<, xrefs: 00A35589
.cmd, xrefs: 00A3545F
%s\System32\cmd.exe, xrefs: 00A354A9
Parameters:<, xrefs: 00A355C6
Window Visibility:, xrefs: 00A355E3
Directory:<, xrefs: 00A355B2
Verb:<, xrefs: 00A3559E
Hidden, xrefs: 00A355D6
runas, xrefs: 00A354EC
.bat, xrefs: 00A35422
open, xrefs: 00A354D5
Visible, xrefs: 00A355DB, 00A355EA
GetProcessId, xrefs: 00A35672, 00A356A1
/C ""%s" %s", xrefs: 00A354C1

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectProcessSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 697762045-2796270252
Opcode ID: 3eca98360e3ddffd4fbfb51ed660a732d16f301fa62b82e5fedf724f10ffd0b4
Instruction ID: 74bb326b32a839fbf236dfa0f186378fe0ab939127354fef0168d3fd5dad6bc0
Opcode Fuzzy Hash: 3eca98360e3ddffd4fbfb51ed660a732d16f301fa62b82e5fedf724f10ffd0b4
Instruction Fuzzy Hash: 89E1C171E00A099BCB14EFB8C985BAEB7B5FF44710F548669F819AB291E7309D41CB90

Function 00A3C870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00A3CBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00A8E6D0,00000800), ref: 00A3CBD3

Strings

/HideWindow, xrefs: 00A3C98E, 00A3C9AC, 00A3C9B1
/DIR , xrefs: 00A3C9F3
/EnforcedRunAsAdmin , xrefs: 00A3C893, 00A3C8A3, 00A3C8A8
/LogFile, xrefs: 00A3CA07
/RunAsAdmin , xrefs: 00A3C92B, 00A3C94C, 00A3C951
/DontWait , xrefs: 00A3C8D8, 00A3C8EE, 00A3C8F3

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: 3bccf14dd34396046544153640b349c8532753611cb76a98a03b1137f0768201
Instruction ID: 69bc62199b2d14db44efbd3998af7e841d8dcd24b9282e4b52f250b364c6c8c9
Opcode Fuzzy Hash: 3bccf14dd34396046544153640b349c8532753611cb76a98a03b1137f0768201
Instruction Fuzzy Hash: F9C1D435A042168BCB34AF24DC0137AB7A1FF95760F598459F88AEB291E771CD82C791

Function 00A33860 Relevance: 10.7, APIs: 7, Instructions: 227processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A338CB
CloseHandle.KERNEL32(00000000), ref: 00A3390B
Process32FirstW.KERNEL32(?,00000000), ref: 00A3395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A3397A
CloseHandle.KERNEL32(00000000), ref: 00A33A8E
Process32NextW.KERNEL32(?,00000000), ref: 00A33AA2
CloseHandle.KERNEL32(?), ref: 00A33AF0

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 05a46e697eb37936c5e99c8b7bb92256caca93ee5e991281795e4302b40c8758
Instruction ID: 0f4ed1fe94921f871b69664765c1bc345aa6f12ebd63bc0d851001ba2601aba0
Opcode Fuzzy Hash: 05a46e697eb37936c5e99c8b7bb92256caca93ee5e991281795e4302b40c8758
Instruction Fuzzy Hash: ACA10BB1D05249DFDF10CFA9D998BDEBBF8BF48304F248159E805AB290D7755A44CBA0

Function 00A6F032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A6F216

Strings

1#SNAN, xrefs: 00A6F13E
1#IND, xrefs: 00A6F137
1#INF, xrefs: 00A6F168
1#QNAN, xrefs: 00A6F145

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 82372e5e322b604f89a20581f96eb2a1d3d60b94f25cc48188217b682f485d50
Instruction ID: e0d027c359377fc6bdad7d18fc64c5e023079af40c00e565deb1983e759c33d1
Opcode Fuzzy Hash: 82372e5e322b604f89a20581f96eb2a1d3d60b94f25cc48188217b682f485d50
Instruction Fuzzy Hash: 3BD20872E082298FDB65CF28DD40BEAB7B5EB44305F1481EAD84DE7241E774AE858F41

Function 00A6E5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A6E8D1,00000002,00000000,?,?,?,00A6E8D1,?,00000000), ref: 00A6E64C
GetLocaleInfoW.KERNEL32(?,20001004,00A6E8D1,00000002,00000000,?,?,?,00A6E8D1,?,00000000), ref: 00A6E675
GetACP.KERNEL32(?,?,00A6E8D1,?,00000000), ref: 00A6E68A

Strings

OCP, xrefs: 00A6E607
ACP, xrefs: 00A6E5D1

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f8e7f6562827ae7f2560432b05e5dcbf7b88e956a2d646fa696e2a0ee6166e80
Instruction ID: dc0241c0bdeccc0811abb62c6b3655aa19e267a4823169c9734720ddcf7e954a
Opcode Fuzzy Hash: f8e7f6562827ae7f2560432b05e5dcbf7b88e956a2d646fa696e2a0ee6166e80
Instruction Fuzzy Hash: 48218E3EB00201AADB34CF54CA04A9B77B6AB74F64B568564E90AD7110FB32DE41C790

Function 00A39CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A39E60
LocalFree.KERNEL32(00000000), ref: 00A39EB7
_swprintf.LIBCMT ref: 00A3A0A0
LocalFree.KERNEL32(00000000), ref: 00A3A0F7
_swprintf.LIBCMT ref: 00A3A183

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: 75d1ab145dc4ed687d175b11cb4603cc55f2f56db52a0d0c6b0a0eef3f7ba80e
Instruction ID: f3fc1a7067c4bc0550122391bae1ac924153454683a11f923d2e58585d6e57f5
Opcode Fuzzy Hash: 75d1ab145dc4ed687d175b11cb4603cc55f2f56db52a0d0c6b0a0eef3f7ba80e
Instruction Fuzzy Hash: 63F1BB71E00219AFDF19DFA8DD41BAEBBB5FF49310F144229F811AB280D775A941CBA1

Function 00A6E788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00A6E894
IsValidCodePage.KERNEL32(00000000), ref: 00A6E8DD
IsValidLocale.KERNEL32(?,00000001), ref: 00A6E8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00A6E934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00A6E953

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6d47cef9b6d0fb3b249ec51a95b7d4357319b01b095299e14895a8fc6dbab89a
Instruction ID: 406c9aed4e4f1946f488982bae533d7fea344ebfd58a3e6de86eb3a949e12890
Opcode Fuzzy Hash: 6d47cef9b6d0fb3b249ec51a95b7d4357319b01b095299e14895a8fc6dbab89a
Instruction Fuzzy Hash: C7518E75A00215AFEF20DFA9DD45ABE73B8FF59700F144569E904EB190EB70D944CBA0

Function 00A65D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A65DFA

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: c2fc8d119e0b5410a5f008ea6ab513e860964660be8a10824d745bce374c8485
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: 73B14572E046459FDF15CF78C881BEEBBB5EF59300F15816AE905AB241D235DE01CBA1

Function 00A6B02D Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00A6B0C8
FindNextFileW.KERNEL32(00000000,?), ref: 00A6B143
FindClose.KERNEL32(00000000), ref: 00A6B165
FindClose.KERNEL32(00000000), ref: 00A6B188

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 3d8bdf9d0e52d62b620ccfbdd8e4993543a9aa8b6f31938fbb20a0615eb09354
Instruction ID: 2d7205298f0444824a31aecf868e5f786412aa38823a1175bfb51c7608ee6c0e
Opcode Fuzzy Hash: 3d8bdf9d0e52d62b620ccfbdd8e4993543a9aa8b6f31938fbb20a0615eb09354
Instruction Fuzzy Hash: CF41B671910619AEDB20EFA8DD99AAFB7B8EB85305F108195E419D7180E7309EC48F70

Function 00A533A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A533B4
IsDebuggerPresent.KERNEL32 ref: 00A53480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A534A0
UnhandledExceptionFilter.KERNEL32(?), ref: 00A534AA

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fa977d39f8830a1c9d90b08323651168af0f189e19a8a4ee7559a56512f53f63
Instruction ID: 15b81e472d5065eb10b7a9bda48eb35c3f4b11f1f75a5486193445311be0da8a
Opcode Fuzzy Hash: fa977d39f8830a1c9d90b08323651168af0f189e19a8a4ee7559a56512f53f63
Instruction Fuzzy Hash: 7B313875D0521C9BDF10DFA0D989BCDBBB8BF08305F1041AAE50CAB250EB719B898F44

Function 00A3D0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A3C630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,9666CEAE,?,00A73D30,000000FF), ref: 00A3C657
Part of subcall function 00A3C630: GetLastError.KERNEL32(?,00000000,00000000,9666CEAE,?,00A73D30,000000FF), ref: 00A3C661

IsDebuggerPresent.KERNEL32(?,?,00A88AF0), ref: 00A3D0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00A88AF0), ref: 00A3D0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A3D0E2

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 0a963ab7b62be8e112ba6ef9197fc322d9c5811f32b464ef5d6c7b3d5039f26e
Instruction ID: d66b81ec7d358c121f26673c0df710286789591925b82dce2bcaaf55d54047c3
Opcode Fuzzy Hash: 0a963ab7b62be8e112ba6ef9197fc322d9c5811f32b464ef5d6c7b3d5039f26e
Instruction Fuzzy Hash: 70E09270204741CFD324EF78ED0474A7BE4AF12700F00C96DF49AD2651EBB4D48A8BA1

Function 00A6E237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6E28B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6E2D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6E39B

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 9c5d16ec64d549edc0176c592b719bdd5ac60d40f8dd2f96cf4900ec46c6d408
Instruction ID: 6a96bdb2466e03d8497f7e674fee6135ae9fc04ef789024ed519d9e0f0c8b883
Opcode Fuzzy Hash: 9c5d16ec64d549edc0176c592b719bdd5ac60d40f8dd2f96cf4900ec46c6d408
Instruction Fuzzy Hash: 3C619D799002079FEB28DF28CD86BAA77B8FF14301F108179ED15CA295EB79D985CB50

Function 00A56E1B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A56F13
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A56F1D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00A56F2A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 17277b23a3d097ca1ee3e1d0bc07aee8f94733d90f4c9b5e88adfb93d827ca33
Instruction ID: b61681c40364d63fc5e3a607d4ef8d2c675f89648e9d40448ea762a5824be667
Opcode Fuzzy Hash: 17277b23a3d097ca1ee3e1d0bc07aee8f94733d90f4c9b5e88adfb93d827ca33
Instruction Fuzzy Hash: 1831C575901218ABCB21DF64DD897CDBBB8BF18311F5041EAE81CA7250E7709F858F44

Function 00A345B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,9666CEAE,00000001,00000000,?,00000000,00A74460,000000FF,?,00A3474D,00A33778,?,00000000,00000000,?), ref: 00A345DB
LockResource.KERNEL32(00000000,?,00000000,00A74460,000000FF,?,00A3474D,00A33778,?,00000000,00000000,?,?,?,?,00A33778), ref: 00A345E6
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00A74460,000000FF,?,00A3474D,00A33778,?,00000000,00000000,?,?,?), ref: 00A345F4

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: cc94c4f59ba48952184b35cd7db482d2f9ac0361e74b4b57b9be52fd63682768
Instruction ID: ca1f5d0663eac482ff4a2f9991248bf0ab5523937f9d26ba05e44b0d959246ed
Opcode Fuzzy Hash: cc94c4f59ba48952184b35cd7db482d2f9ac0361e74b4b57b9be52fd63682768
Instruction Fuzzy Hash: 0811C632A046949BC735CF59DC55B6AF7FCE789725F00493AFC1AD3250EB35AC018690

Function 00A5E270 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction ID: c7f4342c3c82e58bdad8c1a59dbe7dab67ed1adfe671a420b704deff3c6b4851
Opcode Fuzzy Hash: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction Fuzzy Hash: 74F14171E002199FDF18CF69C9806ADB7B1FF88325F158269E815AB381E731AE05CF90

Function 00A67B1F Relevance: 1.9, APIs: 1, Instructions: 410timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00A67F64,00000000,00000000,00000000), ref: 00A67E23

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 8eb462875e162ab111d7d977daed237ed8d1bde48c26b3640b03d6a6f95c1838
Instruction ID: c402b3c04e4825d86b7a91819d782bb58ae6c2f923fa2ff1a4cdc11dd73d3ed0
Opcode Fuzzy Hash: 8eb462875e162ab111d7d977daed237ed8d1bde48c26b3640b03d6a6f95c1838
Instruction Fuzzy Hash: B9D11572A14215EBDB24EBA4DD02ABE7BB9EF04758F244556F901EB291F7308E41CB90

Function 00A684BD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A684B8,?,?,00000008,?,?,00A714E4,00000000), ref: 00A686EA

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6a8a739cf813969c933763c59aa583da33a2c6b5b84e056544caa58b1799fd89
Instruction ID: 4a50e3ee45e5e8d24cd58123fa7ce8a9dcb07dd43d41662832b6616c4b65e562
Opcode Fuzzy Hash: 6a8a739cf813969c933763c59aa583da33a2c6b5b84e056544caa58b1799fd89
Instruction Fuzzy Hash: 1EB14B35610608CFDB14CF28C48AB657BF4FF45364F258658E99ACF2A1CB39E992CB40

Function 00A535A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A535BF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6e3e6ddf0705ef3c11ec7ad22d0dd29c6d5b1952c03b487ab9ac2211321a1b45
Instruction ID: 7f0e19822e11b9f178e2623326e531ebdb3e9d256f727ed9442fafb8ec705e4f
Opcode Fuzzy Hash: 6e3e6ddf0705ef3c11ec7ad22d0dd29c6d5b1952c03b487ab9ac2211321a1b45
Instruction Fuzzy Hash: 4951A0B2D11205DFEB15CF99E8817AABBF0FB88395F24852AC805EB390D3749A05CF50

Function 00A5A587 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00A5A715

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e1d658e69434e423c1e8fd0e1649b5b571970244c2a778b1969ef777af2b5269
Instruction ID: 559c53ab1728088bc2407c209c17fd906706f61293bc797dee2579f8e8272d0d
Opcode Fuzzy Hash: e1d658e69434e423c1e8fd0e1649b5b571970244c2a778b1969ef777af2b5269
Instruction Fuzzy Hash: F4C1C074B006468FCB28CF28C590A7EBBB1BF29312F284719DC5697691D730AD4ECB52

Function 00A6E48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A6E4DE

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0613303e06cdf1fc3c7da41b997a350953b6582e2b785bc0fc6156da1400f21f
Instruction ID: ba457d6d91b8261be0dbadd2d137921ff77bcd9d505cd5c86679d9cd8ed23756
Opcode Fuzzy Hash: 0613303e06cdf1fc3c7da41b997a350953b6582e2b785bc0fc6156da1400f21f
Instruction Fuzzy Hash: 2221BE76A44206ABDB28EF24DD42ABA73B8EF04318F10007AFD06D6281FB34ED058B50

Function 00A6E111 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

EnumSystemLocalesW.KERNEL32(00A6E237,00000001,00000000,?,-00000050,?,00A6E868,00000000,?,?,?,00000055,?), ref: 00A6E183

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ba5f1a9cf0e98bf989b30d9ae4f0e5844fcc7939a177f0a4f1fb028a7f438876
Instruction ID: ab80be297363a1c2b24f9fd1571428b4bf01a6178f6b4ee3d2b99253af431c21
Opcode Fuzzy Hash: ba5f1a9cf0e98bf989b30d9ae4f0e5844fcc7939a177f0a4f1fb028a7f438876
Instruction Fuzzy Hash: 3111293E2007019FDF18DF38C8A15BAB7A2FF80719B15452CE54647A40D3717943DB40

Function 00A6E6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A6E453,00000000,00000000,?), ref: 00A6E6E5

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 80f112f882a7c72780b7d81fa45a1f933ddb7a13f5dc48688ed338fc670f5389
Instruction ID: ab5fec572e54acec2690ae6bb9bb616dc55e74bd99be5a210a9e4a1ae3733e04
Opcode Fuzzy Hash: 80f112f882a7c72780b7d81fa45a1f933ddb7a13f5dc48688ed338fc670f5389
Instruction Fuzzy Hash: 1DF0CD3AA00212BFDB28DB64CD09BFA7778EB40754F154834EC15A3180EA74FD41C690

Function 00A6E1AC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

EnumSystemLocalesW.KERNEL32(00A6E48A,00000001,?,?,-00000050,?,00A6E82C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00A6E1F6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eed596a8b92a445b61fd3d208ec91630a044d5d1a34341f18ac7115a621a6e86
Instruction ID: 01e4f7305da080d095d5a02c7af9528a76462cf269637884fa313abb916eb6e5
Opcode Fuzzy Hash: eed596a8b92a445b61fd3d208ec91630a044d5d1a34341f18ac7115a621a6e86
Instruction Fuzzy Hash: 30F0463A2003046FCB249F348C85A7A7BA9FF81728F04842CF9058BA80D6B19C42DB50

Function 00A67132 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00A61C9A: EnterCriticalSection.KERNEL32(-00A8DE50,?,00A63576,?,00A8A078,0000000C,00A63841,?), ref: 00A61CA9

EnumSystemLocalesW.KERNEL32(Function_00037125,00000001,00A8A1D8,0000000C,00A67554,?), ref: 00A6716A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6e35b9da40b2617744530e68117ed68fb2b97ae81439dc2d4a4a809610bf615d
Instruction ID: feb94750599f2919c4e4185781e6aa9ee5a97978044e1f47ede48e1d8b2c16e9
Opcode Fuzzy Hash: 6e35b9da40b2617744530e68117ed68fb2b97ae81439dc2d4a4a809610bf615d
Instruction Fuzzy Hash: 60F06D72E54200EFD704EF98E946B9C7BF0FB49725F00866AF415DB2A0EB7549418F50

Function 00A6E0C6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A657CC: GetLastError.KERNEL32(?,00000008,00A6AD4C), ref: 00A657D0
Part of subcall function 00A657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00A65872

EnumSystemLocalesW.KERNEL32(00A6E01F,00000001,?,?,?,00A6E88A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00A6E0FD

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: af5f6195c0e8916997a50c5ef95af34efde77f8a2ee577070a56f126c9e570cc
Instruction ID: 4737d638c18ccf80c2ae8a8300bdcaed168aa6fd54d0687ec4d22acb425d8e79
Opcode Fuzzy Hash: af5f6195c0e8916997a50c5ef95af34efde77f8a2ee577070a56f126c9e570cc
Instruction Fuzzy Hash: 71F0E53A3402059BCB04EF75DC4566A7FA9EFC2760F074468EA198B651C6719882DB90

Function 00A523F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00A500E2,00000000,00000000,00000004,00A4ED14,00000000,00000004,00A4F127,00000000,00000000), ref: 00A52410

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2b33984ded7514c91bcc620f2c39b64e790d603f002edfbc384b5cb5e4787ce8
Instruction ID: d9ca1b153e7b83e2c63a43098317079a0949ed196ca3ac898243a52473278490
Opcode Fuzzy Hash: 2b33984ded7514c91bcc620f2c39b64e790d603f002edfbc384b5cb5e4787ce8
Instruction Fuzzy Hash: 31E0D832664104BAD7258BB8AE0FFBA7AB8F70270BF504151FD02D40D1DAB1CA44A361

Function 00A676AF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00A64E3F,?,20001004,00000000,00000002,?,?,00A64441), ref: 00A676E3

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 216015abb3bcfd02e12ebefb7cdcbc52df6f16e3a0204f0a073781934be4fd51
Instruction ID: 112a60a75daaec527e658af7f599ca24b50e8a383e12ae6f3f2a16be7987d5b1
Opcode Fuzzy Hash: 216015abb3bcfd02e12ebefb7cdcbc52df6f16e3a0204f0a073781934be4fd51
Instruction Fuzzy Hash: 0BE04F3651862CBBCF126F61DD08AAE3F36EF44754F004020FC0566171CB318D61ABD5

Function 00A5353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002354B,00A53077), ref: 00A53544

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 37dbafdbe87c79226b93f069a4a204cbcfd2990fba9cdc54e568c06c4e6f7552
Instruction ID: 176c8f009845889b4a51b13dbe7ff74536cfc77e30077142828f19e6231bf441
Opcode Fuzzy Hash: 37dbafdbe87c79226b93f069a4a204cbcfd2990fba9cdc54e568c06c4e6f7552
Instruction Fuzzy Hash:

Function 00A32310 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A52C98: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CA3
Part of subcall function 00A52C98: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CE0

GetProcessHeap.KERNEL32 ref: 00A32365

Part of subcall function 00A52C4E: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C58
Part of subcall function 00A52C4E: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C8B
Part of subcall function 00A52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00A52D02

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: abbfdcdcd4f45cd2cc46a47d4ce310601ce54b2a91001a72ea1480ecf50536cc
Instruction ID: f183dad40d0fa5ca2d16d8c84119294457dcb853862a1c73d9b74048412f021c
Opcode Fuzzy Hash: abbfdcdcd4f45cd2cc46a47d4ce310601ce54b2a91001a72ea1480ecf50536cc
Instruction Fuzzy Hash: 2621BDB0941280EFD310EF98ED06B4977B0FB26325F004638E825973E0F770190A8F52

Function 00A60A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d1597c666eef88f70c3d305a0c12419302900beecb527de7aea05fa262c6874b
Instruction ID: 14be22ba92736cc669f5b29719089b956dd3066c5d4bcfdf14789816e264544c
Opcode Fuzzy Hash: d1597c666eef88f70c3d305a0c12419302900beecb527de7aea05fa262c6874b
Instruction Fuzzy Hash: 5A329E74A0021ADFCF28CFA8C991ABEBBB5EF45304F18416DDD45A7345D632AE46CB90

Function 00A692A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7676ebb8353089d8efab13f8034101a48c1790b03e8dbe6cb33738656e9a97e9
Instruction ID: c521142014d5e66d8c8c1684b6910f190d8a79becb31eb6c051de2908e4b6003
Opcode Fuzzy Hash: 7676ebb8353089d8efab13f8034101a48c1790b03e8dbe6cb33738656e9a97e9
Instruction Fuzzy Hash: 8532E062D29F414DD7239674CC6233AA29CAFB73C4F15D727E81AB5AA9EB39C4C34100

Function 00A5A915 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b4463869c3e4c75c5f9de5f1a07c1b828e5eae8936768c477fe5927e7162a0
Instruction ID: 4a7020c37093859808208e3ffb30b813a34d459a84d8d11fdbfa87fe270ada24
Opcode Fuzzy Hash: 20b4463869c3e4c75c5f9de5f1a07c1b828e5eae8936768c477fe5927e7162a0
Instruction Fuzzy Hash: E7E1CD70700605CFCB24CF68C680ABAB7F1FF69312F258759D9569B291D730AD4ACB62

Function 00A5C2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction ID: e4bbff7eadda2d5f68f120db8275efc4f8ee095a75a784401a01b20d8eb0f473
Opcode Fuzzy Hash: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction Fuzzy Hash: 18517272E00219AFDF14CF99C991AAEBBB2FF88310F19C059E815AB205D7349E54DB91

Function 00A54920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: cfa1bcd661b9e8772165263bf357e9de155066ea14b7daaa28a4f216daf663a0
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6D110877205182C3D604C72ED4BA5B7E395FBCE32F72D436AD8918B758D232A9CD9600

Function 00A6AD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 2b92896c137d9890d485e92e0627947d1c5c5f494b78a03a35dabac38c5114f8
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: 5CE08C72911238EBCB14DB98CA08A8AF3FCEB84B01B15049AF601E3500C670DE00DBD1

Function 00A62DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction ID: 50472dcf616b9186b15905be430a0e7c3cb38d0114f0b47bd3af26ade713cd2e
Opcode Fuzzy Hash: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction Fuzzy Hash: 79C04C34141F40C6DE2A9A148AB17A93375B7A1782F94158CC5474BA86C51EAC87DB11

Function 00A36600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00A3667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00A366D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00A366E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00A366FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00A749E5,000000FF), ref: 00A367DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00A749E5,000000FF), ref: 00A367E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00A749E5), ref: 00A3682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,00A749E5,000000FF), ref: 00A3684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00A749E5), ref: 00A36867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00A749E5,000000FF), ref: 00A36891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00A368D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00A3692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00A749E5,000000FF), ref: 00A3695C

Strings

-_.~!*'();:@&=+$,/?#[], xrefs: 00A36757, 00A3676E
open, xrefs: 00A368D1, 00A368F0
[InternetShortcut]URL=, xrefs: 00A3670A
URL Shortcut content:, xrefs: 00A36875

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: d02658c265aaa11a92e2842dcaf94beb87774caeb6e5f3ae9404a66f120f48e2
Instruction ID: 148c8ce9ae77e69a952c7854b4ba34c70efe37faac9dffcf3b4689700ec56b8b
Opcode Fuzzy Hash: d02658c265aaa11a92e2842dcaf94beb87774caeb6e5f3ae9404a66f120f48e2
Instruction Fuzzy Hash: 7DB13671904249AFEB20DF68CD86BEFBBB5EF45700F548129F904AB2C1D7709A49C7A1

Function 00A52B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00A8DD3C,00000FA0,?,?,00A52B6A), ref: 00A52B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00A52B6A), ref: 00A52BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00A52B6A), ref: 00A52BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A52BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A52BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00A52B6A), ref: 00A52BF7
DeleteCriticalSection.KERNEL32(00A8DD3C,00000007,?,?,00A52B6A), ref: 00A52C13
CloseHandle.KERNEL32(00000000,?,?,00A52B6A), ref: 00A52C23

Strings

WakeAllConditionVariable, xrefs: 00A52BCC
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A52B9E
kernel32.dll, xrefs: 00A52BAF
SleepConditionVariableCS, xrefs: 00A52BC0

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: de0cf06e2562efacd25244a37799cb325c2ce67fa4cbee4f859488f2971c2024
Instruction ID: 56097a3005fb3bf0975058cc65451261bf812dd79ee10c83ca63d6cc4a84f32c
Opcode Fuzzy Hash: de0cf06e2562efacd25244a37799cb325c2ce67fa4cbee4f859488f2971c2024
Instruction Fuzzy Hash: 1B017571A85311ABD6219FB5AC0DF5E3B68BF52752B01CC11BD08D22E0EA74C847CB61

Function 00A55CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00A55DAC
type_info::operator==.LIBVCRUNTIME ref: 00A55DCE
___TypeMatch.LIBVCRUNTIME ref: 00A55EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00A55FAF
_UnwindNestedFrames.LIBCMT ref: 00A56033
CallUnexpected.LIBVCRUNTIME ref: 00A5604E

Strings

csm, xrefs: 00A55E05
csm, xrefs: 00A55D59
csm, xrefs: 00A55CEC

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 4f705b28044c9db3a38ad06adb2fd6a969f573c566871f6bba4b2c060ba915aa
Instruction ID: 993f85e363a15f10e1f1660b2dfdcd6774ae09efee4f0d94fa8b35382b85bce3
Opcode Fuzzy Hash: 4f705b28044c9db3a38ad06adb2fd6a969f573c566871f6bba4b2c060ba915aa
Instruction Fuzzy Hash: 89B18A32C00609EFCF28DFA4D9A19AEBBB5FF14316F14805AEC156B212D730DA59CB91

Function 00A34270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,9666CEAE,?,?,?), ref: 00A342D2
OpenProcess.KERNEL32(00000400,00000000,?,?,9666CEAE,?,?,?), ref: 00A342F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,9666CEAE,?,?,?), ref: 00A34326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,9666CEAE,?,?,?), ref: 00A34337
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A34355
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A34371
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A34399
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A343B5
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A343D3
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A343EF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 5e556d161698a254df51657e42962ca4242fea0104c0f1d46757f6a2819352e7
Instruction ID: fa52d11efb92aea2bbbb62547bfaab8a4fef414b1ace3e2240c11eed10895a3c
Opcode Fuzzy Hash: 5e556d161698a254df51657e42962ca4242fea0104c0f1d46757f6a2819352e7
Instruction Fuzzy Hash: 2A5159B0D05618EBDB10DF99DD84BAEBBB8FF49714F244219E514BB280C7746D058BA4

Function 00A4BBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4BBC4

Part of subcall function 00A4254E: __EH_prolog3.LIBCMT ref: 00A42555
Part of subcall function 00A4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00A4255F
Part of subcall function 00A4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00A425D0

Strings

%H : %M, xrefs: 00A4BD03
%m / %d / %y, xrefs: 00A4BCBB
%H : %M : %S, xrefs: 00A4BD5D
%d / %m / %y, xrefs: 00A4BEFA
%b %d %H : %M : %S %Y, xrefs: 00A4BE52
:AM:am:PM:pm, xrefs: 00A4BF2A
%I : %M : %S %p, xrefs: 00A4BF1F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: ec18bb8a2467578dbefb9a508a9073f93746fe05ed282cf39087d7435fd3309c
Instruction ID: 7b935d0a82a85d0cee0cfa26e65aa245f0a44f53a0ec8ff6fc0aa840728979fe
Opcode Fuzzy Hash: ec18bb8a2467578dbefb9a508a9073f93746fe05ed282cf39087d7435fd3309c
Instruction Fuzzy Hash: 79B17F7A51010AABCF19DF68CE96DFE3BB9FB88304F144119FA0AA6251D731DA10DB60

Function 00A50C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A50CA4

Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392A0
Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392C2
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A392EA
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A39422

Strings

%H : %M, xrefs: 00A50DE3
%m / %d / %y, xrefs: 00A50D9B
%H : %M : %S, xrefs: 00A50E3D
%d / %m / %y, xrefs: 00A50FDA
%b %d %H : %M : %S %Y, xrefs: 00A50F32
:AM:am:PM:pm, xrefs: 00A5100A
%I : %M : %S %p, xrefs: 00A50FFF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 0aa845b5eb6a417bc0b284da711861f51ba468b27c706b1abbe6e14a1e86fc37
Instruction ID: efe274e294ea1d9c9a028c7170b427bfb3cdaf2b630bbbcd0509d0e57b3e385e
Opcode Fuzzy Hash: 0aa845b5eb6a417bc0b284da711861f51ba468b27c706b1abbe6e14a1e86fc37
Instruction Fuzzy Hash: F0B1AF7650010AAFCF29DF68CD5AEFE3BB9FB14302F144519FD06A6291D631DA18DB60

Function 00A4BF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4BF85

Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38657
Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38679
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A386A1
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3880E

Strings

%H : %M, xrefs: 00A4C0C4
%m / %d / %y, xrefs: 00A4C07C
%H : %M : %S, xrefs: 00A4C11E
%d / %m / %y, xrefs: 00A4C2BB
%b %d %H : %M : %S %Y, xrefs: 00A4C213
:AM:am:PM:pm, xrefs: 00A4C2EB
%I : %M : %S %p, xrefs: 00A4C2E0

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 9254d7e0d89af287156587198b98ea51503a4ae96b0ae59811ef5377d2aed400
Instruction ID: e3ea638496af760233c73cf1ef16b744abefdaec9be1594959e05f4c74db9f93
Opcode Fuzzy Hash: 9254d7e0d89af287156587198b98ea51503a4ae96b0ae59811ef5377d2aed400
Instruction Fuzzy Hash: BAB1E27A50110AEFCF59EFA8CD55DFE3BB9FB88360F008119F90AA7251D6719A10CB60

Function 00A48555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4855C
_Maklocstr.LIBCPMT ref: 00A485C5
_Maklocstr.LIBCPMT ref: 00A485D7
_Maklocchr.LIBCPMT ref: 00A485EF
_Maklocchr.LIBCPMT ref: 00A485FF
_Getvals.LIBCPMT ref: 00A48621

Part of subcall function 00A41CD4: _Maklocchr.LIBCPMT ref: 00A41D03
Part of subcall function 00A41CD4: _Maklocchr.LIBCPMT ref: 00A41D19

Strings

true, xrefs: 00A485D2
false, xrefs: 00A485C0

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 5255a4bfcfff401b61a613f41f203c152fa6fac6a4f3c76fcd550dd00de8f6e1
Instruction ID: 69a40c7815d0a04e5e0181774896f173b80bd30d09598a184fd145520fd43f8d
Opcode Fuzzy Hash: 5255a4bfcfff401b61a613f41f203c152fa6fac6a4f3c76fcd550dd00de8f6e1
Instruction Fuzzy Hash: A32192B6D00304ABDF14EFA4D986ADE7BB8AF45750F008116F9159F142DBB08644CBA1

Function 00A39730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00A39763

Part of subcall function 00A40C94: __EH_prolog3.LIBCMT ref: 00A40C9B
Part of subcall function 00A40C94: std::_Lockit::_Lockit.LIBCPMT ref: 00A40CA6
Part of subcall function 00A40C94: std::locale::_Setgloballocale.LIBCPMT ref: 00A40CC1
Part of subcall function 00A40C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00A40D17

std::_Lockit::_Lockit.LIBCPMT ref: 00A3978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A397F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00A3984A

Part of subcall function 00A3F57A: __EH_prolog3.LIBCMT ref: 00A3F581

LocalFree.KERNEL32(00000000,00000000,?,00A854B1,00000000), ref: 00A399BF
__cftoe.LIBCMT ref: 00A39B0B

Strings

bad locale name, xrefs: 00A398FF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockitstd::locale::_$H_prolog3Lockit::_$FreeInitLocalLocimp::_Locinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3578231455-1405518554
Opcode ID: ebc83e49cb17cdcbfd77aa990750e9df21470ef37ea4aec97012cc57f97064ef
Instruction ID: f5b653b09e824b02b56f6f5634ee3d95efb9e4ade5c8f9e51c8916071c30e915
Opcode Fuzzy Hash: ebc83e49cb17cdcbfd77aa990750e9df21470ef37ea4aec97012cc57f97064ef
Instruction Fuzzy Hash: BBF1AB71D01249DFDF10CFA8D985BAEBBB5FF49304F244169E805AB381E7B59A04CBA1

Function 00A33C20 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A336D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00A33735
Part of subcall function 00A336D0: _wcschr.LIBVCRUNTIME ref: 00A337C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00A33CA8
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 00A33D01
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 00A33D7A
ReadProcessMemory.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 00A33EB1
GetLastError.KERNEL32 ref: 00A33F34
FreeLibrary.KERNEL32(?), ref: 00A33F7B

Strings

NtQueryInformationProcess, xrefs: 00A33CA2

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: MemoryProcessRead$AddressDirectoryErrorFreeLastLibraryProcSystem_wcschr
String ID: NtQueryInformationProcess
API String ID: 566592816-2781105232
Opcode ID: b52a4831b8214c0a6a79fbb6f02093ccfa0aad35e14078b11f6a3b0ba2ca270c
Instruction ID: 94ac1f7d737c5e09460b91fa12c40533c45206bc2e375c974a9300db76e98bde
Opcode Fuzzy Hash: b52a4831b8214c0a6a79fbb6f02093ccfa0aad35e14078b11f6a3b0ba2ca270c
Instruction Fuzzy Hash: 1DA15A71904749DEDB20DF64CD49BAEBBF0BF48704F204599E449A7280E7B5AA88CF91

Function 00A340B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,9666CEAE,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00A34154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,9666CEAE,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00A34177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A34217
OpenProcess.KERNEL32(00000400,00000000,?,9666CEAE,?,?,?), ref: 00A342D2
OpenProcess.KERNEL32(00000400,00000000,?,?,9666CEAE,?,?,?), ref: 00A342F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,9666CEAE,?,?,?), ref: 00A34326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,9666CEAE,?,?,?), ref: 00A34337
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A34355
CloseHandle.KERNEL32(00000000,?,9666CEAE,?,?,?), ref: 00A34371

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: b6e2546dc91cd75f50b23ea4c92638e1a31f128aade609a4f170392fdee78a18
Instruction ID: 24d5f65e131c4a5c42430045517531b749ec685ff96876bf8dcf92095d37ec9e
Opcode Fuzzy Hash: b6e2546dc91cd75f50b23ea4c92638e1a31f128aade609a4f170392fdee78a18
Instruction Fuzzy Hash: E1819D71A006059FDB14CFA8DD85BAEBBB5FB4C310F248229F925B7390D770A9418B90

Function 00A5266D Relevance: 12.2, APIs: 8, Instructions: 224COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00A526F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A52786
__alloca_probe_16.LIBCMT ref: 00A527B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A527F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A52812
__alloca_probe_16.LIBCMT ref: 00A52838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A52875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00A52892

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 09e5f9fdc8d017b4b3367291833f61b5964f3754e05c97c6e55df9458b361373
Instruction ID: d1d87cb080f2422c8e3e69bf137ca98ea01a1e461adec0c5d9d84efee480caea
Opcode Fuzzy Hash: 09e5f9fdc8d017b4b3367291833f61b5964f3754e05c97c6e55df9458b361373
Instruction Fuzzy Hash: EE71A07290020AABDF21CFA4CD81BEE7BB6FF5A352F280119ED04A7251D731C849CB60

Function 00A5215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00A521A3
__alloca_probe_16.LIBCMT ref: 00A521CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00A5220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A5222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00A5226A
__alloca_probe_16.LIBCMT ref: 00A52287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A522C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A522EC

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: bca9a5df1dc349530fc8f49ff7d50623ac04060749265b8eaa72d0908f47af23
Instruction ID: 5915e00de0c67ad81364abfb7c1d1442f343ff8d7f3ca78751e46cfd640bd6d6
Opcode Fuzzy Hash: bca9a5df1dc349530fc8f49ff7d50623ac04060749265b8eaa72d0908f47af23
Instruction Fuzzy Hash: 7C51917250020AABDB208FA4CC45FEF7BB9FF46752F154528FE15AA150D7348D19DB60

Function 00A38610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A38657
std::_Lockit::_Lockit.LIBCPMT ref: 00A38679
std::_Lockit::~_Lockit.LIBCPMT ref: 00A386A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,9666CEAE,?,00000000), ref: 00A386F9
__Getctype.LIBCPMT ref: 00A3877B
std::_Facet_Register.LIBCPMT ref: 00A387E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3880E

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: 8fb5bc2c8b66bab85006120584c2ebcb228bcbabaeb55e9237ef2dacc30b8b31
Instruction ID: 5e3d4d9e784af0448adf1da909a5a444b50b0ef43af8ddce5ca5fdb11adbbe42
Opcode Fuzzy Hash: 8fb5bc2c8b66bab85006120584c2ebcb228bcbabaeb55e9237ef2dacc30b8b31
Instruction Fuzzy Hash: CB61BFB1D00744DFDB11CF68CA41B9ABBF4FF14314F248259E845AB391EB78AA45CB91

Function 00A39270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A392A0
std::_Lockit::_Lockit.LIBCPMT ref: 00A392C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00A392EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,9666CEAE,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00A39342
__Getctype.LIBCPMT ref: 00A393BD
std::_Facet_Register.LIBCPMT ref: 00A393F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00A39422

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: e574cf740e25bca4f913d41edbd5fab01d54480fa758bd2536bf57d0633402a3
Instruction ID: 7c1773e5be44c54d46ef3726a00d03c9c7f7a66a22d1a1d33a558627f08b1ab5
Opcode Fuzzy Hash: e574cf740e25bca4f913d41edbd5fab01d54480fa758bd2536bf57d0633402a3
Instruction Fuzzy Hash: 1851AAB1904609DFCB11CFA8C944BAFBBF4EF14714F20815DE846AB291E7B4AA45CB90

Function 00A53F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A53F57
___except_validate_context_record.LIBVCRUNTIME ref: 00A53F5F
_ValidateLocalCookies.LIBCMT ref: 00A53FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A54013
_ValidateLocalCookies.LIBCMT ref: 00A54068

Strings

csm, xrefs: 00A53FFD

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6ce7671ff6ceae596af984ec7baf593ab2a5cda573f535469a36052502fb3d7a
Instruction ID: a2a111e93aefab22f8929cb5cf08fb7f48d9bfb3d46e9fd916f40e9028f883bf
Opcode Fuzzy Hash: 6ce7671ff6ceae596af984ec7baf593ab2a5cda573f535469a36052502fb3d7a
Instruction Fuzzy Hash: 4A41C235E00208ABCF10DF68C885A9EBBB5BF84369F148455ED189F392D7319E5DCB90

Function 00A672FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A67408,00A63841,0000000C,?,00000000,00000000,?,00A67632,00000021,FlsSetValue,00A7BD58,00A7BD60,?), ref: 00A673BC

Strings

api-ms-, xrefs: 00A67352
ext-ms-, xrefs: 00A67366

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0ba0e0b8366668ef523498905893196259b2e093d267b735fdb5933788b9ab05
Instruction ID: 2bebb2206db01d3b9d035e3d893e3bfd58453474f0b6d593b6fd9fe741858419
Opcode Fuzzy Hash: 0ba0e0b8366668ef523498905893196259b2e093d267b735fdb5933788b9ab05
Instruction Fuzzy Hash: E721E475B19211EBCB21DBA4AC41E6E3778EF41764F244620FD19AB390E730ED01E6E0

Function 00A48969 Relevance: 9.4, APIs: 6, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A48970
ctype.LIBCPMT ref: 00A489B7

Part of subcall function 00A4851C: __Getctype.LIBCPMT ref: 00A4852B

Part of subcall function 00A4270D: __EH_prolog3.LIBCMT ref: 00A42714
Part of subcall function 00A4270D: std::_Lockit::_Lockit.LIBCPMT ref: 00A4271E
Part of subcall function 00A4270D: std::_Lockit::~_Lockit.LIBCPMT ref: 00A4278F

Part of subcall function 00A3F3D9: __EH_prolog3.LIBCMT ref: 00A3F3E0
Part of subcall function 00A3F3D9: std::_Lockit::_Lockit.LIBCPMT ref: 00A3F3EA
Part of subcall function 00A3F3D9: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3F48E

Part of subcall function 00A42837: __EH_prolog3.LIBCMT ref: 00A4283E
Part of subcall function 00A42837: std::_Lockit::_Lockit.LIBCPMT ref: 00A42848
Part of subcall function 00A42837: std::_Lockit::~_Lockit.LIBCPMT ref: 00A428B9

Part of subcall function 00A3F3D9: Concurrency::cancel_current_task.LIBCPMT ref: 00A3F499

Part of subcall function 00A429F6: __EH_prolog3.LIBCMT ref: 00A429FD
Part of subcall function 00A429F6: std::_Lockit::_Lockit.LIBCPMT ref: 00A42A07
Part of subcall function 00A429F6: std::_Lockit::~_Lockit.LIBCPMT ref: 00A42A78

Part of subcall function 00A42961: __EH_prolog3.LIBCMT ref: 00A42968
Part of subcall function 00A42961: std::_Lockit::_Lockit.LIBCPMT ref: 00A42972
Part of subcall function 00A42961: std::_Lockit::~_Lockit.LIBCPMT ref: 00A429E3

collate.LIBCPMT ref: 00A48B05
numpunct.LIBCPMT ref: 00A48DAF
__Getcoll.LIBCPMT ref: 00A48B47

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

Part of subcall function 00A36330: LocalAlloc.KERNEL32(00000040,?,00A40E04,00000020,?,?,00A39942,00000000,9666CEAE,?,?,?,?,00A750DD,000000FF), ref: 00A36336

codecvt.LIBCPMT ref: 00A48E6D

Part of subcall function 00A42E09: __EH_prolog3.LIBCMT ref: 00A42E10
Part of subcall function 00A42E09: std::_Lockit::_Lockit.LIBCPMT ref: 00A42E1A
Part of subcall function 00A42E09: std::_Lockit::~_Lockit.LIBCPMT ref: 00A42E8B

Part of subcall function 00A42F33: __EH_prolog3.LIBCMT ref: 00A42F3A
Part of subcall function 00A42F33: std::_Lockit::_Lockit.LIBCPMT ref: 00A42F44
Part of subcall function 00A42F33: std::_Lockit::~_Lockit.LIBCPMT ref: 00A42FB5

Part of subcall function 00A422FA: __EH_prolog3.LIBCMT ref: 00A42301
Part of subcall function 00A422FA: std::_Lockit::_Lockit.LIBCPMT ref: 00A4230B
Part of subcall function 00A422FA: std::_Lockit::~_Lockit.LIBCPMT ref: 00A4237C

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID:
API String ID: 3494022857-0
Opcode ID: 4929aa9e37b811ba2d259eab7725d5ee06047808061ffe71cdb5b34f0ab911c0
Instruction ID: 654815c335334c5e701120193a64a6c9599c16e16c98a205790b14e961989d1f
Opcode Fuzzy Hash: 4929aa9e37b811ba2d259eab7725d5ee06047808061ffe71cdb5b34f0ab911c0
Instruction Fuzzy Hash: 74E1C474C02215AFEB107F709E46A7F7AA5EF81760F14842DF859AB281DF798D0097E2

Function 00A3B500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A3B531
std::_Lockit::_Lockit.LIBCPMT ref: 00A3B54F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,9666CEAE,?,00000000,00000000), ref: 00A3B5CF
std::_Facet_Register.LIBCPMT ref: 00A3B6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B6E1

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: be537352430473d22896d39b45c398ade99098780ea89d2574aee733752bd89c
Instruction ID: 787a43e0df4011a31737fbc9daffb15fa8485dffb4bc748b4a7c6495906a1924
Opcode Fuzzy Hash: be537352430473d22896d39b45c398ade99098780ea89d2574aee733752bd89c
Instruction Fuzzy Hash: 3F51E371900308DFDB11CFA8C981BAEBBB5FF50314F24816DE916AB392D7B59A05CB91

Function 00A3B700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A3B731
std::_Lockit::_Lockit.LIBCPMT ref: 00A3B74F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B777
LocalAlloc.KERNEL32(00000040,00000008,00000000,9666CEAE,?,00000000,00000000), ref: 00A3B7CF
std::_Facet_Register.LIBCPMT ref: 00A3B863
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B88D

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: 9ee3f7748105e8de8a9681da0b11d684f8c5a86327320b0722f759a35aa481e6
Instruction ID: 93972f5c5b625f2b905e7ca46cd661452e0709a7561ae49719cbfddca8369bec
Opcode Fuzzy Hash: 9ee3f7748105e8de8a9681da0b11d684f8c5a86327320b0722f759a35aa481e6
Instruction Fuzzy Hash: 6A51CD74901214DFCB21CFA8C980BAEBBB5FF54710F24866DE905AB381D7B0AE01CB90

Function 00A60351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A6043B
__freea.LIBCMT ref: 00A604D1
__freea.LIBCMT ref: 00A604ED

Strings

am/pm, xrefs: 00A60551
a/p, xrefs: 00A605B5

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 28cdaf971a4fe3333244f88e906ba8982d9e03fc148bc461ca1eff7dd470ae00
Instruction ID: 19000dfadf1a65dca589848c93f359a3fb4e153cdf3a678b3e614f47a689d6f9
Opcode Fuzzy Hash: 28cdaf971a4fe3333244f88e906ba8982d9e03fc148bc461ca1eff7dd470ae00
Instruction Fuzzy Hash: 5BC1DE79900606DBDB248F68C989EBFB7B0FF55700F248049E906AB690D775ADC1CFA1

Function 00A55978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A5596F,00A54900,00A5358F), ref: 00A55986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A55994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A559AD
SetLastError.KERNEL32(00000000,00A5596F,00A54900,00A5358F), ref: 00A559FF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4e092cd80504a5b307e97d1f29c5f0a62450f022c5021cb179bb7337a5b2d7d2
Instruction ID: 0b433222f1f113770c614591a089558713f689698e4d165dfa3a27488be28d47
Opcode Fuzzy Hash: 4e092cd80504a5b307e97d1f29c5f0a62450f022c5021cb179bb7337a5b2d7d2
Instruction Fuzzy Hash: 1D01B132609A12EFE62567F47D96A6A2B74FB017BB7300329FC14961E0EE354C4A9690

Function 00A33230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,9666CEAE,?,00000004), ref: 00A33294
MoveFileW.KERNEL32(?,00000000), ref: 00A3354A
DeleteFileW.KERNEL32(?), ref: 00A33592

Part of subcall function 00A31A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 00A31AF7
Part of subcall function 00A31A70: LocalFree.KERNEL32(7FFFFFFE), ref: 00A31B7D

Part of subcall function 00A32E60: LocalFree.KERNEL32(?,9666CEAE,?,?,00A73C40,000000FF,?,00A31242,9666CEAE,?,?,00A73C75,000000FF), ref: 00A32EB1

Strings

url, xrefs: 00A333B9, 00A33575
URL, xrefs: 00A3328E, 00A3357A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: f01e46bcffd6bdb2c801e0076d3aca56564b6c31c2e41bf46482b06136c04d8f
Instruction ID: 21a852f32e46b4bda7f8b196eae486fe2c1324e85916c421edca4a642c56e459
Opcode Fuzzy Hash: f01e46bcffd6bdb2c801e0076d3aca56564b6c31c2e41bf46482b06136c04d8f
Instruction Fuzzy Hash: 05C17770D182689ADF24DF64CD99BDDBBB4BF14304F1042D9E409A7291EBB46B88CF91

Function 00A336D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00A33735
GetLastError.KERNEL32(?,?,?,00A74215,000000FF), ref: 00A3381A

Part of subcall function 00A32310: GetProcessHeap.KERNEL32 ref: 00A32365

Part of subcall function 00A346F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,00A33778,-00000010,?,?,?,00A74215,000000FF), ref: 00A34736

_wcschr.LIBVCRUNTIME ref: 00A337C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00A74215,000000FF), ref: 00A337DB

Strings

ntdll.dll, xrefs: 00A337B3

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: fe2ab736a886367436acbfdcbf9bf92a06099ae7a623945b9c7a5511173e3309
Instruction ID: da9849b490161d895d5e9255a7c56d2eca6ff35b13a5d8d416639214f9ff6443
Opcode Fuzzy Hash: fe2ab736a886367436acbfdcbf9bf92a06099ae7a623945b9c7a5511173e3309
Instruction Fuzzy Hash: 3F418372A04605AFDB10DFA8DD55BAEB7B4FF14310F14862DF916D7281EBB0AA04CB91

Function 00A3621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31A20: LocalFree.KERNEL32(?), ref: 00A31A42

Part of subcall function 00A53E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00A31434,?,?,00A3D341,00A31434,00A88B5C,?,00A31434,?,00000000), ref: 00A53EBA

GetCurrentProcess.KERNEL32(9666CEAE,9666CEAE,?,?,00000000,00A74981,000000FF), ref: 00A362EB

Part of subcall function 00A52C98: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CA3
Part of subcall function 00A52C98: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00A362B0
GetProcAddress.KERNEL32(00000000), ref: 00A362B7

Part of subcall function 00A52C4E: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C58
Part of subcall function 00A52C4E: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C8B
Part of subcall function 00A52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00A52D02

Strings

IsWow64Process, xrefs: 00A362A6
kernel32, xrefs: 00A362AB

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: 15177331c45396afbe41ba140fa56d9975b908807d0c2902495d5e4333acc9c3
Instruction ID: ceb3c8c0e7e49fb9501f403d84437a9bd608cd9bdd2d31dd25593a21893dbc5d
Opcode Fuzzy Hash: 15177331c45396afbe41ba140fa56d9975b908807d0c2902495d5e4333acc9c3
Instruction Fuzzy Hash: 9321CDB1D44305EFCB10EFE4DE06B9EB7A8FB18B11F104625F915A32D0EB7469018B61

Function 00A48451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A48458
_Getvals.LIBCPMT ref: 00A484AA
_Mpunct.LIBCPMT ref: 00A484E5
_Mpunct.LIBCPMT ref: 00A484FF

Strings

$+xv, xrefs: 00A4850A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 3ed8a1bd8084cdec5320bec99b16f8269b2fe698e80de743a3fd84da933f7855
Instruction ID: eccadada3fdbab1fa836422aa8098df098f5267d12cbf2e53c70e0d0584cf517
Opcode Fuzzy Hash: 3ed8a1bd8084cdec5320bec99b16f8269b2fe698e80de743a3fd84da933f7855
Instruction Fuzzy Hash: A421C1B5804B926EDB25DF74D89077FBEF8AB48301F044A5AE459C7A42D734E601CBA0

Function 00A36250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(9666CEAE,9666CEAE,?,?,00000000,00A74981,000000FF), ref: 00A362EB

Part of subcall function 00A52C98: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CA3
Part of subcall function 00A52C98: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00A362B0
GetProcAddress.KERNEL32(00000000), ref: 00A362B7

Part of subcall function 00A52C4E: EnterCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C58
Part of subcall function 00A52C4E: LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C8B
Part of subcall function 00A52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00A52D02

Strings

IsWow64Process, xrefs: 00A362A6
kernel32, xrefs: 00A362AB

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: 7a57e0c9b1267ded8c3f86140f567f5da08c86d17a3f3899d8ffe4336dde8852
Instruction ID: 832bdf70ec824fe0e1323dd138819264d676716752b7aaf05774048278b3dccd
Opcode Fuzzy Hash: 7a57e0c9b1267ded8c3f86140f567f5da08c86d17a3f3899d8ffe4336dde8852
Instruction Fuzzy Hash: F611ACB2D48714EFCB10DFA4DD05B9AB7A8FB19B20F00466AEC25936D0EB756901CB91

Function 00A569E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00A56AA3,?,?,00A8DDCC,00000000,?,00A56BCE,00000004,InitializeCriticalSectionEx,00A797E8,InitializeCriticalSectionEx,00000000), ref: 00A56A72

Strings

api-ms-, xrefs: 00A56A32

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 38607b01fdef8296c73b5a4d07a33c19357f8d70992b3e8e748b704887808a83
Instruction ID: b9f6e0e2d8c6669484b4f1a20217b2c04c273674a200ede9ebd7618cad218820
Opcode Fuzzy Hash: 38607b01fdef8296c73b5a4d07a33c19357f8d70992b3e8e748b704887808a83
Instruction Fuzzy Hash: 7511A331A44225ABCF22CBA89C41B5E33B4BF117B2F548260FE19FB280D670ED0586D5

Function 00A62DEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9666CEAE,?,?,00000000,00A76A6C,000000FF,?,00A62DC1,?,?,00A62D95,?), ref: 00A62E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A62E35
FreeLibrary.KERNEL32(00000000,?,00000000,00A76A6C,000000FF,?,00A62DC1,?,?,00A62D95,?), ref: 00A62E57

Strings

CorExitProcess, xrefs: 00A62E2D
mscoree.dll, xrefs: 00A62E1C

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 58607f682d1ec9bc45f8dc8f45da43b964c3755145b8d43c74cab499c0bd6656
Instruction ID: e35dc10f5d50eeea46ed7d5a241c271e84eed9ad513f71b1c9d7b92ab3824d45
Opcode Fuzzy Hash: 58607f682d1ec9bc45f8dc8f45da43b964c3755145b8d43c74cab499c0bd6656
Instruction Fuzzy Hash: 3E01AD32948A19BFCB12CF80CC05FAEBBB8FB04B10F008625F815A22E0DB759901CB90

Function 00A66DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A66E40
__alloca_probe_16.LIBCMT ref: 00A66F01
__freea.LIBCMT ref: 00A66F68

Part of subcall function 00A65BDC: RtlAllocateHeap.NTDLL(00000000,00000000,00A63841,?,00A6543A,?,00000000,?,00A56CE7,00000000,00A63841,00000000,?,?,?,00A6363B), ref: 00A65C0E

__freea.LIBCMT ref: 00A66F7D
__freea.LIBCMT ref: 00A66F8D

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 99f7442a45aa2191dbbeb07e6d8506dc46031813f3538f84c224765b3d17b471
Instruction ID: ad170eee0a964ba28d93d85435b7463417932716c9acb3de86fd4fbc31933dbc
Opcode Fuzzy Hash: 99f7442a45aa2191dbbeb07e6d8506dc46031813f3538f84c224765b3d17b471
Instruction Fuzzy Hash: 1C518F72600206AFEB219FA5ED81EBF7AB9EF44754F150129FD08DB251EB32DC108B60

Function 00A3B8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A3B8DD
std::_Lockit::_Lockit.LIBCPMT ref: 00A3B900
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B928
std::_Facet_Register.LIBCPMT ref: 00A3B98D
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B9B7

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: acaec6593b970aa644e5cfc94f86721851f89807ccecf8e5288ab48becf6714e
Instruction ID: 410ac183c4883c1b7c8da0c5ef167de822411241e93fe051315bc2c22fbf48b8
Opcode Fuzzy Hash: acaec6593b970aa644e5cfc94f86721851f89807ccecf8e5288ab48becf6714e
Instruction Fuzzy Hash: 9331E435900218DFCB11DF94DA81BAEBBB5EF24724F144169FA546B3A1D731AE02CBA1

Function 00A35890 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,75EF4450,00A35646,?,?,?,?,?), ref: 00A35898

Strings

Last error=, xrefs: 00A358D9
true, xrefs: 00A358A7, 00A358B6
false, xrefs: 00A358A2
Call to ShellExecuteEx() returned:, xrefs: 00A358AF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 8b6732ceb4e1f0fc9978b5a2544381726a959d89fb84e46ce8959eb70a95f2d1
Instruction ID: fc44bba1c76e9ed7bd95205b09c51838102d2659c3f64c096df8bfbe58f6cb61
Opcode Fuzzy Hash: 8b6732ceb4e1f0fc9978b5a2544381726a959d89fb84e46ce8959eb70a95f2d1
Instruction Fuzzy Hash: EE118E56E1062587CB302F7CD80036AA2E4DF50764F65047FEC89DB391FAA98C818394

Function 00A41C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00A41C62
_Maklocstr.LIBCPMT ref: 00A41C7F
_Maklocstr.LIBCPMT ref: 00A41C9C
_Maklocchr.LIBCPMT ref: 00A41CAE
_Maklocchr.LIBCPMT ref: 00A41CC1

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 8accf105bee51f69b336f77d01c510bc4ed9c1798bafe105e544ce4d00e5597b
Instruction ID: 063c23b65caa354272d0ebe626b7abe864663ff72149e9a498c8bb4952852d0f
Opcode Fuzzy Hash: 8accf105bee51f69b336f77d01c510bc4ed9c1798bafe105e544ce4d00e5597b
Instruction Fuzzy Hash: 241191B5940784BFE720DBA4CD82F22B7ECAF84350F044519F655CBA41D2A4FC9087A9

Function 00A3D87C Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A3D883
std::_Lockit::_Lockit.LIBCPMT ref: 00A3D88D

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

numpunct.LIBCPMT ref: 00A3D8C7
std::_Facet_Register.LIBCPMT ref: 00A3D8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3D8FE

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 9fcdc78a29ae3e64f71849122911a4694f917f2983cc2e26c60b34df4c29a7ab
Instruction ID: 8138eeb96f968ecf6827e9694092cd08af503de2e0adfdd248d6fe3b3f624b5f
Opcode Fuzzy Hash: 9fcdc78a29ae3e64f71849122911a4694f917f2983cc2e26c60b34df4c29a7ab
Instruction Fuzzy Hash: D7110436900615DFCF05FBA4E941ABE7774BF94710F244419F811AB2D1CF74AE058B90

Function 00A4238F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42396
std::_Lockit::_Lockit.LIBCPMT ref: 00A423A0

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

codecvt.LIBCPMT ref: 00A423DA
std::_Facet_Register.LIBCPMT ref: 00A423F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42411

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: c561a11145284f08bb5b5ade3716779e4d7df50d909107226eb64c14b085c1d5
Instruction ID: e798e5104d8f1420ed23fce152297f866ad6777e50f254ce6062aa1e286ea00d
Opcode Fuzzy Hash: c561a11145284f08bb5b5ade3716779e4d7df50d909107226eb64c14b085c1d5
Instruction Fuzzy Hash: 6D01D23A900119DFCB04EBA4DA41ABE77B1BFC0710F244819F4106B2D2CF789E05CB90

Function 00A424B9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A424C0
std::_Lockit::_Lockit.LIBCPMT ref: 00A424CA

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

collate.LIBCPMT ref: 00A42504
std::_Facet_Register.LIBCPMT ref: 00A4251B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4253B

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 66be0376c71e96ca573a60e45c4a0f53d3d843f10f9f0e81d299fde68fa19cce
Instruction ID: 6ef797effbd9c6f79d4722a8ff3d0bc5003d6b8963c878e5d76f08a9b09535db
Opcode Fuzzy Hash: 66be0376c71e96ca573a60e45c4a0f53d3d843f10f9f0e81d299fde68fa19cce
Instruction Fuzzy Hash: 0001DE3A900619DBCB19EBA4EA45AAE77B0BFD4720F254409F410AB2D1CF789E058B91

Function 00A42424 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4242B
std::_Lockit::_Lockit.LIBCPMT ref: 00A42435

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

collate.LIBCPMT ref: 00A4246F
std::_Facet_Register.LIBCPMT ref: 00A42486
std::_Lockit::~_Lockit.LIBCPMT ref: 00A424A6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: b362bc424b3830d0dfacb13b6399752c93fd0c724bbf5f13d465714ff908c970
Instruction ID: 5b5b56155df7c366f68812917c5304258e0d9d8367de6c6002bafcfd9883bbcd
Opcode Fuzzy Hash: b362bc424b3830d0dfacb13b6399752c93fd0c724bbf5f13d465714ff908c970
Instruction Fuzzy Hash: 2501C03A900215DFCF04EBA0EA41AAEBB60BFC4720F254409F5106B2D2DFB89E45CB90

Function 00A425E3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A425EA
std::_Lockit::_Lockit.LIBCPMT ref: 00A425F4

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

messages.LIBCPMT ref: 00A4262E
std::_Facet_Register.LIBCPMT ref: 00A42645
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42665

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 94e614eb9441a0cc0e4fa091856e53b9a4c6a1e1b8668613356a920a6e54c23c
Instruction ID: 01e2a54f3018a2898e4ae2c171e24a1be5bab0f0c1c6b6516c057b08a864d62c
Opcode Fuzzy Hash: 94e614eb9441a0cc0e4fa091856e53b9a4c6a1e1b8668613356a920a6e54c23c
Instruction Fuzzy Hash: D001CC3A900219DBCB05EBA0AA51AAEB7A1FFD0710F254409F810AB2D2CF749E01CB90

Function 00A4254E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42555
std::_Lockit::_Lockit.LIBCPMT ref: 00A4255F

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

ctype.LIBCPMT ref: 00A42599
std::_Facet_Register.LIBCPMT ref: 00A425B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00A425D0

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 424cdba222c648c93d524d76258a226e1553829353799c905053e147e575dd28
Instruction ID: 11389dd5366f195852dcc8503ae23fd5a94c8d5da5d9851897bcbb8788b97d19
Opcode Fuzzy Hash: 424cdba222c648c93d524d76258a226e1553829353799c905053e147e575dd28
Instruction Fuzzy Hash: 8201D23A901219DBCF04EBA0D951AAE7770BFD4720F654809F410AB2D2DF789E45CB91

Function 00A42678 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4267F
std::_Lockit::_Lockit.LIBCPMT ref: 00A42689

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

messages.LIBCPMT ref: 00A426C3
std::_Facet_Register.LIBCPMT ref: 00A426DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00A426FA

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: c8303a0542018a257a99d70e0f741780b7e1b2095fe56d3eb3195de42907bffa
Instruction ID: ca51a567ed6c44d76e9fb86202cf761c536c3ab5bb2e4a1251720d4caf573bc3
Opcode Fuzzy Hash: c8303a0542018a257a99d70e0f741780b7e1b2095fe56d3eb3195de42907bffa
Instruction Fuzzy Hash: EE01C03A900615DFCF05EBA4D941BAEB770BFD4710F254849F5106B2D1CF749E058B90

Function 00A4E8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4E8DF
std::_Lockit::_Lockit.LIBCPMT ref: 00A4E8E9

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

messages.LIBCPMT ref: 00A4E923
std::_Facet_Register.LIBCPMT ref: 00A4E93A
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4E95A

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: d1a2f3d27ba7949fc112e4f228355c71ada9d7c61136eed3d27cf79a62e36bf5
Instruction ID: 7d7b5a667dcb56248f2c154e82adab3715b390570eb50ac324e00dddb3f5c534
Opcode Fuzzy Hash: d1a2f3d27ba7949fc112e4f228355c71ada9d7c61136eed3d27cf79a62e36bf5
Instruction Fuzzy Hash: B701C03A900215DFCF04EBA09941ABEB7A0BFC0710F250849F514AB2D2CF749E018791

Function 00A4E843 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4E84A
std::_Lockit::_Lockit.LIBCPMT ref: 00A4E854

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

collate.LIBCPMT ref: 00A4E88E
std::_Facet_Register.LIBCPMT ref: 00A4E8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4E8C5

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 433914229ba24f717913903ce805f3088a25d31741d4788a2537a685b7f88d1f
Instruction ID: 45bb68766e96305775ba442f9f8b5d18403d067f1ab2d6f1ea95a0aaefef57b5
Opcode Fuzzy Hash: 433914229ba24f717913903ce805f3088a25d31741d4788a2537a685b7f88d1f
Instruction Fuzzy Hash: E901923A900519DFCF05FBA4D941AAE77B1BFD4710F244409F914AB2D1CF749E058B91

Function 00A429F6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A429FD
std::_Lockit::_Lockit.LIBCPMT ref: 00A42A07

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A42A41
std::_Facet_Register.LIBCPMT ref: 00A42A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42A78

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: bb633bb17eceda9a00cdf3924da7f0670237a8c01d08d222e25eb1e5fb3789ea
Instruction ID: 54fdd13eb608bfd17b73a2b1e18058ec6b5438e6f44019cd68b51e6eae09fdd9
Opcode Fuzzy Hash: bb633bb17eceda9a00cdf3924da7f0670237a8c01d08d222e25eb1e5fb3789ea
Instruction Fuzzy Hash: 9801D23A900215DFCB15EBA4D941BBE77B1BFD4760F254419F9106B2D2CF749E018790

Function 00A42961 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42968
std::_Lockit::_Lockit.LIBCPMT ref: 00A42972

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A429AC
std::_Facet_Register.LIBCPMT ref: 00A429C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00A429E3

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 61a90eb62d55171a9e9c7efc854d451f2d35e97e4096b8b7afdd9a92c4fb12f8
Instruction ID: ba89785a4c1df91a72d4d2968a3e10235e6433bac973a2578b5ccd4ef215410a
Opcode Fuzzy Hash: 61a90eb62d55171a9e9c7efc854d451f2d35e97e4096b8b7afdd9a92c4fb12f8
Instruction Fuzzy Hash: EB01DE3A900619DFCB14EBA4DA42AAE77B0BFC4710F254909F910AB2D2CF749E018B91

Function 00A42A8B Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42A92
std::_Lockit::_Lockit.LIBCPMT ref: 00A42A9C

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A42AD6
std::_Facet_Register.LIBCPMT ref: 00A42AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42B0D

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 2d8e9af4184ed99495fbe2d2298e79daa8aaa4c9b59c6d7b8a8bd25300044837
Instruction ID: ebbbec10df9d8026e4be30534163fde04404dbce7c6858ddbf7691a36d1f33c6
Opcode Fuzzy Hash: 2d8e9af4184ed99495fbe2d2298e79daa8aaa4c9b59c6d7b8a8bd25300044837
Instruction Fuzzy Hash: 6501C439900615DFCB15EBA49941BAE77A1BFD4710F244809F904A72D2CF749E01CB91

Function 00A4EA97 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4EA9E
std::_Lockit::_Lockit.LIBCPMT ref: 00A4EAA8

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A4EAE2
std::_Facet_Register.LIBCPMT ref: 00A4EAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4EB19

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 70109ecfe3f0125e5b40b0776acd93ce8dbfa4e90de58175124c5cda9213f489
Instruction ID: 1fde9e7f053e432efedb61591bb3fd21a613f0ee2700ee62985f5fcf8f9bb28f
Opcode Fuzzy Hash: 70109ecfe3f0125e5b40b0776acd93ce8dbfa4e90de58175124c5cda9213f489
Instruction Fuzzy Hash: C101D23A900619DFCB14EBA0DA41AAE7771FFD0720F244849F405AB2D2DF749E06C791

Function 00A42B20 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42B27
std::_Lockit::_Lockit.LIBCPMT ref: 00A42B31

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A42B6B
std::_Facet_Register.LIBCPMT ref: 00A42B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42BA2

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: f57ab4cca41a1d52e5346c6d2eac5fb8d005a66a5f0c99857b4af7b875940eb7
Instruction ID: a63b41023d6d131b70a93e34e7b8500030fe52579b317b0cca906a41eb31f4f2
Opcode Fuzzy Hash: f57ab4cca41a1d52e5346c6d2eac5fb8d005a66a5f0c99857b4af7b875940eb7
Instruction Fuzzy Hash: 3601D23A900615DBCF14FBA4D941ABE7771BFC4720F254409F5046B2D2CFB49E068791

Function 00A4EB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4EB33
std::_Lockit::_Lockit.LIBCPMT ref: 00A4EB3D

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

moneypunct.LIBCPMT ref: 00A4EB77
std::_Facet_Register.LIBCPMT ref: 00A4EB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4EBAE

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 45bfb7baca94857f1780fd004f070d271da4a102f6ba1d2ca9664748286ce59d
Instruction ID: 40eb9d6543ea0be0c27fb1c2fb466a974f94c13e9b5f66a70f9f019ad712ec7f
Opcode Fuzzy Hash: 45bfb7baca94857f1780fd004f070d271da4a102f6ba1d2ca9664748286ce59d
Instruction Fuzzy Hash: C201D23A900515DFCF04FBA0D981AAE7770BFC4710F258809F4156B2D2CFB49E068B91

Function 00A42D74 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00A42D85

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

numpunct.LIBCPMT ref: 00A42DBF
std::_Facet_Register.LIBCPMT ref: 00A42DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42DF6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 3c28b951eabcacdea1255e7597e051b2da72646ce2a7fd548c8632e53a3f3c5b
Instruction ID: 6049ac0453cfc9beb209bdad2a958822ea594bfc367d8fa66d3560cafe635a99
Opcode Fuzzy Hash: 3c28b951eabcacdea1255e7597e051b2da72646ce2a7fd548c8632e53a3f3c5b
Instruction Fuzzy Hash: 1101C039900215DBCB04EBA4DA41BBEB7A0BFD4710F654809F414AB2D2CF749E018790

Function 00A52C4E Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C58
LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,00A32427,00A8E638,00A76B40), ref: 00A52C8B
RtlWakeAllConditionVariable.NTDLL ref: 00A52D02
SetEvent.KERNEL32(?,00A32427,00A8E638,00A76B40), ref: 00A52D0C
ResetEvent.KERNEL32(?,00A32427,00A8E638,00A76B40), ref: 00A52D18

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 0c33f89b8688713fe588d746d1a1b728879953aceeae8f202b001f14f21667b5
Instruction ID: 9514c8b05c54ed4262b53c3831702d53cb21fc4f3b2fb3ebac2593a16f7e872a
Opcode Fuzzy Hash: 0c33f89b8688713fe588d746d1a1b728879953aceeae8f202b001f14f21667b5
Instruction Fuzzy Hash: B901F631506120DFC715EF98FC48A997B75FB49761701846AF90697371DB305943DFA0

Function 00A3BB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,9666CEAE,?,00000000), ref: 00A3BBA3
Concurrency::cancel_current_task.LIBCPMT ref: 00A3BD7F

Strings

true, xrefs: 00A3BCAB
false, xrefs: 00A3BC95

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: 9c8ce238d0eb87fd4b079b68f9d795fde6ac58ca4b1ee837a0976203b03236ac
Instruction ID: c7525d1cddc64a82c0452e2231b3c2279b1313ede4c28f00ddc5df92354bf0b5
Opcode Fuzzy Hash: 9c8ce238d0eb87fd4b079b68f9d795fde6ac58ca4b1ee837a0976203b03236ac
Instruction Fuzzy Hash: AB6182B1D00748DBDB10DFA4C941BDEBBF8FF14304F14826AE955AB281E7B5AA44CB91

Function 00A4D3CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4D3D2

Part of subcall function 00A4254E: __EH_prolog3.LIBCMT ref: 00A42555
Part of subcall function 00A4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00A4255F
Part of subcall function 00A4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00A425D0

_Find_elem.LIBCPMT ref: 00A4D46E

Strings

0123456789-, xrefs: 00A4D41E
%.0Lf, xrefs: 00A4D419

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 2488bb6de8caedf292a6adb8fa83fa2606ce81103e40bd8136cf757010ebf693
Instruction ID: 8a9e2ced955c0c63b85fa993108ca70299eddbfe89b7d2a6d3e82ea5bdd2f595
Opcode Fuzzy Hash: 2488bb6de8caedf292a6adb8fa83fa2606ce81103e40bd8136cf757010ebf693
Instruction Fuzzy Hash: 9741AF36900218DFCF05DFA4C980ADEBBB5FF98314F104159F815AB255DB70EA56CBA2

Function 00A4D66F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4D676

Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38657
Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38679
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A386A1
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3880E

_Find_elem.LIBCPMT ref: 00A4D712

Strings

0123456789-, xrefs: 00A4D6C2
0123456789-, xrefs: 00A4D6BD

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 342b0c8d0ea0f799ddf0eaa975c53d398033511ae1bf64e5924d191b1eab3de6
Instruction ID: b2db812067b5f485593850e6cb4f280f35b03362e1fe465f7b92f183e35c9992
Opcode Fuzzy Hash: 342b0c8d0ea0f799ddf0eaa975c53d398033511ae1bf64e5924d191b1eab3de6
Instruction Fuzzy Hash: D1419C76900218DFCF15EFA8C980ADEBBB5FF58310F104159F815AB256DB30EA56CBA1

Function 00A5175A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A51761

Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392A0
Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392C2
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A392EA
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A39422

_Find_elem.LIBCPMT ref: 00A517FB

Strings

0123456789-, xrefs: 00A517A8
0123456789-, xrefs: 00A517AD

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 4227e31a7fc5b51ada2688e70dc3f4ee623c0255bc9dcb4384e66ce9fb7f86ff
Instruction ID: 7eaee983d5070e372c034699053bc32673a30f9401ae2187d7d183d15fc53e1a
Opcode Fuzzy Hash: 4227e31a7fc5b51ada2688e70dc3f4ee623c0255bc9dcb4384e66ce9fb7f86ff
Instruction Fuzzy Hash: 0D416B31900208EFCF15DFA8D981AEEBBB5BF08310F10455AF811AB252DB34DA46CF91

Function 00A48386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4838D

Part of subcall function 00A41C42: _Maklocstr.LIBCPMT ref: 00A41C62
Part of subcall function 00A41C42: _Maklocstr.LIBCPMT ref: 00A41C7F
Part of subcall function 00A41C42: _Maklocstr.LIBCPMT ref: 00A41C9C
Part of subcall function 00A41C42: _Maklocchr.LIBCPMT ref: 00A41CAE
Part of subcall function 00A41C42: _Maklocchr.LIBCPMT ref: 00A41CC1

_Mpunct.LIBCPMT ref: 00A4841A
_Mpunct.LIBCPMT ref: 00A48434

Strings

$+xv, xrefs: 00A4843F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: b82a4062ab0b885b4eef965a8072ae4efd3929ea8c0aa5e81c131759fe707005
Instruction ID: afd624025df804f627cb16e10350503065e2038fd1735670cd6578ecfa8c7f3d
Opcode Fuzzy Hash: b82a4062ab0b885b4eef965a8072ae4efd3929ea8c0aa5e81c131759fe707005
Instruction Fuzzy Hash: 1E21E0B1804B926EDB25DF74C88077FBEF8AB48300F04065AE499C7A02D734E601CBA0

Function 00A4FFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4FFF1
_Mpunct.LIBCPMT ref: 00A5007E
_Mpunct.LIBCPMT ref: 00A50098

Strings

$+xv, xrefs: 00A500A3

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 153c68146aa36fe883e6f924d140840e8864674228f2d3b6ee8aa590e9f4041e
Instruction ID: 0721451b17996978ae3b62a44d9afefdd6da8e864d4ba55201334397d9b4ce67
Opcode Fuzzy Hash: 153c68146aa36fe883e6f924d140840e8864674228f2d3b6ee8aa590e9f4041e
Instruction Fuzzy Hash: C621A4B1904B916FDB25DF74C890B7BBEF8BB08301F04455AE499C7A42D774E605CB90

Function 00A324C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00A31434,?,00000000), ref: 00A32569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00A31434,?,00000000), ref: 00A32589
LocalFree.KERNEL32(?,00A31434,?,00000000), ref: 00A325DF
CloseHandle.KERNEL32(00000000,9666CEAE,?,00000000,00A73C40,000000FF,00000008,?,?,?,?,00A31434,?,00000000), ref: 00A32633
LocalFree.KERNEL32(?,9666CEAE,?,00000000,00A73C40,000000FF,00000008,?,?,?,?,00A31434), ref: 00A32647

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: aae4a83e1148a2eb799667d9ca24e72509b82727be10a1a6df525714f4c9c2ab
Instruction ID: 6acb5315560b3571c2ef72ec85865ff27d844f9a840b7d2c46799bfc06d59579
Opcode Fuzzy Hash: aae4a83e1148a2eb799667d9ca24e72509b82727be10a1a6df525714f4c9c2ab
Instruction Fuzzy Hash: 4641F872600311ABC714DF78DC94B6ABBE8EB49360F20472AF526C72D0EB34D94587A0

Function 00A71D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9666CEAE,?,00000000,?), ref: 00A71DFE

Part of subcall function 00A6A9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00A66F5E,?,00000000,-00000008), ref: 00A6AA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A72059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A720A1
GetLastError.KERNEL32 ref: 00A72144

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3f4164a6dc8a6fc199f0a1a71adbc537890981460a281e1b1ef37e67b0033870
Instruction ID: e532a0e2f44a04369b7902982d5a9189e17f9ac229c4aeee1a5a3886a9bbe20c
Opcode Fuzzy Hash: 3f4164a6dc8a6fc199f0a1a71adbc537890981460a281e1b1ef37e67b0033870
Instruction Fuzzy Hash: CED14875D002589FCF15CFA8DC80AEDBBB5FF09310F18866AE959E7251D730A946CB60

Function 00A50116 Relevance: 6.3, APIs: 4, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A5011D
collate.LIBCPMT ref: 00A50126

Part of subcall function 00A4EDF2: __EH_prolog3_GS.LIBCMT ref: 00A4EDF9
Part of subcall function 00A4EDF2: __Getcoll.LIBCPMT ref: 00A4EE5D

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

__Getcoll.LIBCPMT ref: 00A5016C
numpunct.LIBCPMT ref: 00A503C4

Part of subcall function 00A36330: LocalAlloc.KERNEL32(00000040,?,00A40E04,00000020,?,?,00A39942,00000000,9666CEAE,?,?,?,?,00A750DD,000000FF), ref: 00A36336

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 259100098-0
Opcode ID: b1bc1350c4d0a5edca156d2e51ce3066980acefe9a128c0112278802ab2e6d95
Instruction ID: a72c9cefe2cb1d0915ba0355e8f3c7395c45ff6d892ac3581b4e5ddb65b30437
Opcode Fuzzy Hash: b1bc1350c4d0a5edca156d2e51ce3066980acefe9a128c0112278802ab2e6d95
Instruction Fuzzy Hash: 2091D771D023116FEB20BBB44E46F7F7AA8FF41761F10852DFD59AB281DA74890487A2

Function 00A55A58 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A55B1F
___AdjustPointer.LIBCMT ref: 00A55B42
___AdjustPointer.LIBCMT ref: 00A55BDE

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 62c4f81d22dcac235018af71de13fae7590a7507a3bf4631d9139a7824d8d7d9
Instruction ID: 3741d10639deb842858b6ff7bf470aab50336251c25f606e008fecc27e454d1d
Opcode Fuzzy Hash: 62c4f81d22dcac235018af71de13fae7590a7507a3bf4631d9139a7824d8d7d9
Instruction Fuzzy Hash: C851F2B2E00B06AFDB289F64D969B6A77B4FF04312F154629ED0187191E731EC88C790

Function 00A624E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eafb92d87eeab80f3880e2278b9542fe2ff82208c182fe6548ffa77002d7643
Instruction ID: 25d361577e8e2cf7d714ef7a9bb5d181337b3f897579d98637dce54ce93c1f42
Opcode Fuzzy Hash: 0eafb92d87eeab80f3880e2278b9542fe2ff82208c182fe6548ffa77002d7643
Instruction Fuzzy Hash: 4A21DE71604A06AF9B30AF64DD61E6F77B8FF443607108925FC169B250EB34ED0097A0

Function 00A36FB0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 00A36FB7

Strings

Call to ShellExecute() for verb<, xrefs: 00A36FC1
Last error=, xrefs: 00A37011
> returned:, xrefs: 00A36FC6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: df73712fa1aaab722fa82bd4efaa6071c9d189697443658d498af7d9091bad8f
Instruction ID: 9878b42f61b41c98c48f30795a00fb29bf1d160cf69ceac7db024cc692fde1d6
Opcode Fuzzy Hash: df73712fa1aaab722fa82bd4efaa6071c9d189697443658d498af7d9091bad8f
Instruction Fuzzy Hash: 4B219F49E1022182CB742F38D51137EA6E0EF54754F64587FECC9DB390FAA98C828391

Function 00A3F3D9 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A3F3E0
std::_Lockit::_Lockit.LIBCPMT ref: 00A3F3EA
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3F48E
Concurrency::cancel_current_task.LIBCPMT ref: 00A3F499

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: 133da6dc82f3e35e912282e34f40840d406be7db14ecb766a219f26e40aa8ecf
Instruction ID: a2097ccebb5eb1380b5b86da4883dcec3321e3bda25fa169b2475dd1ff87c29e
Opcode Fuzzy Hash: 133da6dc82f3e35e912282e34f40840d406be7db14ecb766a219f26e40aa8ecf
Instruction Fuzzy Hash: E0214C34A1061AEFCB04EF14D851AADB771FF48710F118469E9259B3A1CB70EE50CF80

Function 00A3CCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,9666CEAE), ref: 00A3CD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00A3CD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00A3CD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00A3CD86

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 2725f3a3503cbef78ff924faa270eec4957072ad6c5ccb12e545b6d8b6440bba
Instruction ID: 539d52771758cca5daff394ff3b05892fe76ce0b4b3a11ea5a4fc3031304c2c8
Opcode Fuzzy Hash: 2725f3a3503cbef78ff924faa270eec4957072ad6c5ccb12e545b6d8b6440bba
Instruction Fuzzy Hash: 3A21B170941315ABD720DF54DC09FAEBBB8FB05B24F104229F504B72C0D7B46A068BE4

Function 00A422FA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42301
std::_Lockit::_Lockit.LIBCPMT ref: 00A4230B

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4235C
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4237C

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 420cf4e59b5d9454ca37568923d845a7f308c5cc2c9cfb3b0814f73ab097ae49
Instruction ID: 3a79ba188dfb04fbb01a4880caa4d78ec1aa4a8c0102364d25f06f871f80ce11
Opcode Fuzzy Hash: 420cf4e59b5d9454ca37568923d845a7f308c5cc2c9cfb3b0814f73ab097ae49
Instruction Fuzzy Hash: 1A01D23A900615DFCF14EBA4E941ABEB7B0BFC0720F254509F510AB2D1CF78AE058B90

Function 00A3D6BD Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A3D6C4
std::_Lockit::_Lockit.LIBCPMT ref: 00A3D6CE

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A3D71F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3D73F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c52daa9f281455b2d9cfe2d93531a75653c874198697fdc074130d2ba326bce7
Instruction ID: ca23bf77452b4a2e1211b71e430670f161a52c882b159ab879a387300e9fdf00
Opcode Fuzzy Hash: c52daa9f281455b2d9cfe2d93531a75653c874198697fdc074130d2ba326bce7
Instruction Fuzzy Hash: E601DE36900619DFCB05EBA0EA42AAE77B0BF90710F240809F800AB2D2CF749E058B90

Function 00A427A2 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A427A9
std::_Lockit::_Lockit.LIBCPMT ref: 00A427B3

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42804
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42824

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 2dec2dd0ec488183a1eb17c3635dbe43a637c4babc838623b07ca25b7dad28bd
Instruction ID: 7ae89d64eab60f11d4a5001b8e4ee05f6ff5464bf23cfbac700fc21951ec6f31
Opcode Fuzzy Hash: 2dec2dd0ec488183a1eb17c3635dbe43a637c4babc838623b07ca25b7dad28bd
Instruction Fuzzy Hash: 3001D23A900215DBCF15EBA4DA41AAE7771BFD4720F240409F9046B2D2CF749E05CBA1

Function 00A3D7E7 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A3D7EE
std::_Lockit::_Lockit.LIBCPMT ref: 00A3D7F8

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A3D849
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3D869

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: abb8f34d89bb3e8a0491d61a7e8bca80717cbdb0bab5729177886076b43d884a
Instruction ID: effb4aeba1e6854bba4fad7a31be5232fd651c61bfd1aad4e3cfc40aad9c2237
Opcode Fuzzy Hash: abb8f34d89bb3e8a0491d61a7e8bca80717cbdb0bab5729177886076b43d884a
Instruction Fuzzy Hash: DA01F136900619DFCF15FBA4EA42ABE77B1BF90720F244409F500AB2D1CF74AE018B91

Function 00A4270D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42714
std::_Lockit::_Lockit.LIBCPMT ref: 00A4271E

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4276F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4278F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 14e7a4c4017570618205d7ec261397536cdbf62288f5b98700cc6dc332db65cd
Instruction ID: 49f6d805cbccbcddd710a2ff0dd9a6800b9840f048d080d4d2224687e924111d
Opcode Fuzzy Hash: 14e7a4c4017570618205d7ec261397536cdbf62288f5b98700cc6dc332db65cd
Instruction Fuzzy Hash: 9101C03A900215DBCF04EBA09A45AAE7B71BFD4710F240909F8146B2D2CF749E058B90

Function 00A3D752 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A3D759
std::_Lockit::_Lockit.LIBCPMT ref: 00A3D763

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A3D7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00A3D7D4

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 36908e68e476cf5139d1b61b68c5b3f50cf04f93061b50ed3570762de58719a7
Instruction ID: f04879a6d938438a0acb78d165629ce6adcce4d18a8e1060008b2ebbf7d54936
Opcode Fuzzy Hash: 36908e68e476cf5139d1b61b68c5b3f50cf04f93061b50ed3570762de58719a7
Instruction Fuzzy Hash: 4B01DE36900219DFCF04EBA0EA42AAE77B1BF80714F240809F914AB2D2CF749E05CB90

Function 00A428CC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A428D3
std::_Lockit::_Lockit.LIBCPMT ref: 00A428DD

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4292E
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4294E

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 54d484b275a24da60462c0356264fa994e20545bede862496aa72156bf3a1af1
Instruction ID: 94fa119268371b147ab71998e7ca678976c534ffbf031ba3859d5c150d1764e9
Opcode Fuzzy Hash: 54d484b275a24da60462c0356264fa994e20545bede862496aa72156bf3a1af1
Instruction Fuzzy Hash: F501D23A900615DBCB04EBA0DA51BBE77B1BFC4720F244809F514AB2D2CFB49E058BD0

Function 00A42837 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4283E
std::_Lockit::_Lockit.LIBCPMT ref: 00A42848

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42899
std::_Lockit::~_Lockit.LIBCPMT ref: 00A428B9

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: ab3d3b2dfa60939ee05f47c9f66c799e9c7dc69223e63abe27a64f547bdfb8af
Instruction ID: e61cc8f3f69d3928809302c765fdaad164c1d9eaf4d9fe7fcec115839cd29854
Opcode Fuzzy Hash: ab3d3b2dfa60939ee05f47c9f66c799e9c7dc69223e63abe27a64f547bdfb8af
Instruction Fuzzy Hash: 8101C03AD00525DFCB04EBA0DA41ABE77A1BFD0710F240909F514AB2D2CF749E058B91

Function 00A4E96D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4E974
std::_Lockit::_Lockit.LIBCPMT ref: 00A4E97E

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4E9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4E9EF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: bb4d83aa3123090b54c24fee9ff75aee27b582250948cc9c9966d7de07f53406
Instruction ID: 4ba43c40e18e541fca27c209f1911fc2ebcf25d3c1364f6fc02cf366cb3dea7a
Opcode Fuzzy Hash: bb4d83aa3123090b54c24fee9ff75aee27b582250948cc9c9966d7de07f53406
Instruction Fuzzy Hash: FA01F539900125DFCB15EBA4DA42ABEB7B4BFC0711F254949F5106B2D2CF749E01C791

Function 00A4EA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4EA09
std::_Lockit::_Lockit.LIBCPMT ref: 00A4EA13

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4EA64
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4EA84

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1b57a8ef78266326b45898ea8ee96b60bece0de64e4dc8d9b5dfd188d77408e1
Instruction ID: 225cf6eb3a3176e40a242bb109d08c45a7a8c3f3d8b5f7003845c7cbb38c6dd7
Opcode Fuzzy Hash: 1b57a8ef78266326b45898ea8ee96b60bece0de64e4dc8d9b5dfd188d77408e1
Instruction Fuzzy Hash: 2D01D239900215DFCF04EBA0DA45AAE77B0BFD4721F2A4919F4006B2D2CF749E058B91

Function 00A42BB5 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00A42BC6

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42C37

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 76b0c4fbeb263e0ae346cf45ce26cf16361abfada0c3abca7f232a422737b846
Instruction ID: 0b2c43a00c7bf1029f9971676f2a6266df8dd769148705760994e32fb040bab1
Opcode Fuzzy Hash: 76b0c4fbeb263e0ae346cf45ce26cf16361abfada0c3abca7f232a422737b846
Instruction Fuzzy Hash: CA01D23A900619DBCF18FBA4DA41AAE77B0BFD0710F254809F900AB2D2CF749E05CB90

Function 00A4EBC1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4EBC8
std::_Lockit::_Lockit.LIBCPMT ref: 00A4EBD2

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4EC23
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4EC43

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: fdaf0b159a1576c6a576a7a46d5ea5a3f788100af3828b45aae27fac8cbe595c
Instruction ID: ba1c131b75603b00e9515c8d2beba976e2446f580c3634b4d4d66a9d5da44449
Opcode Fuzzy Hash: fdaf0b159a1576c6a576a7a46d5ea5a3f788100af3828b45aae27fac8cbe595c
Instruction Fuzzy Hash: 4801F53A900115DFCB14EBA0DA46ABE77B0BFD0710F240849F514AB2D2DF74AE0187D1

Function 00A42CDF Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00A42CF0

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42D61

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 940785aac6885c3cd1e64a2c48f0161d13c20e001bb37a884bde812c11769381
Instruction ID: ad7771aff118b227933d4bad8e341840ae30d15518c5f47d345dc5907e5d6516
Opcode Fuzzy Hash: 940785aac6885c3cd1e64a2c48f0161d13c20e001bb37a884bde812c11769381
Instruction Fuzzy Hash: 9301CC3AD00219DBCB15EBA0AA41BAE77B1BFC4710F240509F514AB2D2CFB49E06CB91

Function 00A42C4A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42C51
std::_Lockit::_Lockit.LIBCPMT ref: 00A42C5B

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42CCC

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 0722e903a82016cd7ebc542916709d972f2fe87f6770cd57045c5413264341d7
Instruction ID: 590c6bd26c5a45f535fcf7d879da1ffca27703744ebe94c0d39da6ad9efa5add
Opcode Fuzzy Hash: 0722e903a82016cd7ebc542916709d972f2fe87f6770cd57045c5413264341d7
Instruction Fuzzy Hash: 7901DE3A901219DBCB14EBA4DA81BBE77B0BFC4710F254409F510AB3D1CF789E018BA0

Function 00A4EC56 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A4EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00A4EC67

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A4ECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 00A4ECD8

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: b0dba2cc80a9c04dce07e57eed4223bc2e43e11e7f8a18a26fa3fcb720fe9d5f
Instruction ID: ef4b4130ad974ab1c768d2a8fe7ac9134ba615f21b0f0f525cdc69bee4f9b48d
Opcode Fuzzy Hash: b0dba2cc80a9c04dce07e57eed4223bc2e43e11e7f8a18a26fa3fcb720fe9d5f
Instruction Fuzzy Hash: 3B01D23AD00215DFCB05EBA4DA81AAE7771BFC0720F254409F501AB2D1CF749E01C791

Function 00A42E9E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00A42EAF

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42F20

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: ada222320ffd5db3e798d7ed7691a5ea789dc294296d8d5a5a9b2884a0303b4b
Instruction ID: 452fe3d884fa0d8b5de08e7a8b607ee036e86a3de33561c4fa58cf9a930928d1
Opcode Fuzzy Hash: ada222320ffd5db3e798d7ed7691a5ea789dc294296d8d5a5a9b2884a0303b4b
Instruction Fuzzy Hash: D601DE3A900219DBCB05EBA0DA42ABE77B0BFD4710F640819F914AB2D2CF749E05CB90

Function 00A42E09 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42E10
std::_Lockit::_Lockit.LIBCPMT ref: 00A42E1A

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42E8B

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 24f96684cd1015604fa93d9bf8b72d5e58545233d508c7c7421e33bc554e26ac
Instruction ID: c393dd9c1f074b04931f1c84e168763120a7102611b71be2b18102908952717d
Opcode Fuzzy Hash: 24f96684cd1015604fa93d9bf8b72d5e58545233d508c7c7421e33bc554e26ac
Instruction Fuzzy Hash: 4101D63A900519DFCB04EBA4D942AAE7771BFD4710F244909F914672D1CF749E058790

Function 00A42F33 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A42F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00A42F44

Part of subcall function 00A38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00A38C50
Part of subcall function 00A38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00A38C78

std::_Facet_Register.LIBCPMT ref: 00A42F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42FB5

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5d2ccaec8230b0d808205190a830df79479c8c704513c498a1795bca68c66cef
Instruction ID: ce4cebf20f8fe44257d58a5421fbc75fb9c9294db78674bb452a6afe04f37176
Opcode Fuzzy Hash: 5d2ccaec8230b0d808205190a830df79479c8c704513c498a1795bca68c66cef
Instruction Fuzzy Hash: D501C039900515DBCB04EBA09A41ABEB7B1BFD4710F644909F404AB2D2CF749E05CB90

Function 00A73686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00A73053,?,00000001,?,?,?,00A72198,?,?,00000000), ref: 00A7369D
GetLastError.KERNEL32(?,00A73053,?,00000001,?,?,?,00A72198,?,?,00000000,?,?,?,00A7271F,?), ref: 00A736A9

Part of subcall function 00A7366F: CloseHandle.KERNEL32(FFFFFFFE,00A736B9,?,00A73053,?,00000001,?,?,?,00A72198,?,?,00000000,?,?), ref: 00A7367F

___initconout.LIBCMT ref: 00A736B9

Part of subcall function 00A73631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A73660,00A73040,?,?,00A72198,?,?,00000000,?), ref: 00A73644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00A73053,?,00000001,?,?,?,00A72198,?,?,00000000,?), ref: 00A736CE

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f22b6b818874363ba4c1e3bbfb0a8eb0401b4e7eb02d035e36e2f295fae9008b
Instruction ID: 6d81fe0a98062c31bfd2dafb3f5021273508ea89e63f199679f012191151c752
Opcode Fuzzy Hash: f22b6b818874363ba4c1e3bbfb0a8eb0401b4e7eb02d035e36e2f295fae9008b
Instruction Fuzzy Hash: 6EF0F236504158BBCF22AFD5AC0898E3E66FB083A1B01C090FA1D96220C6328961ABA0

Function 00A52D20 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00A52CBD,00000064), ref: 00A52D43
LeaveCriticalSection.KERNEL32(00A8DD3C,?,?,00A52CBD,00000064,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00A52CBD,00000064,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52D5E
EnterCriticalSection.KERNEL32(00A8DD3C,?,00A52CBD,00000064,?,?,?,00A323B6,00A8E638,9666CEAE,?,?,00A73D6D,000000FF), ref: 00A52D65

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: e673656f9836936fe48e8192354fa217441fd1ac0d2e54c76e242583ad21e9f1
Instruction ID: fce623579846d75e2339ea34dae522611b0b9ed58e5cd67463fceabcc0e717f4
Opcode Fuzzy Hash: e673656f9836936fe48e8192354fa217441fd1ac0d2e54c76e242583ad21e9f1
Instruction Fuzzy Hash: 2AE09A32606124BBCB127BC0EC08A8E3F39BF09B21B004420F909661B2C66019838BD1

Function 00A3EC87 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A3EC8E

Part of subcall function 00A3D87C: __EH_prolog3.LIBCMT ref: 00A3D883
Part of subcall function 00A3D87C: std::_Lockit::_Lockit.LIBCPMT ref: 00A3D88D
Part of subcall function 00A3D87C: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3D8FE

_Find_elem.LIBCPMT ref: 00A3EE8A

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00A3ECF6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 775d179c7e539b5131827377b538ba29d9915a032ff21a9b23a7fdbecb44ac6d
Instruction ID: c5ead49f3c84c77cb13600487ed9b6eed60ac0d903ae0d47e47358f54d9ea955
Opcode Fuzzy Hash: 775d179c7e539b5131827377b538ba29d9915a032ff21a9b23a7fdbecb44ac6d
Instruction Fuzzy Hash: 06C15B34E042889FDF25DBA8C550BECBBB2AF55300F2840AAF8956B2C7D7719D46CB51

Function 00A462BE Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A462C8

Part of subcall function 00A42D74: __EH_prolog3.LIBCMT ref: 00A42D7B
Part of subcall function 00A42D74: std::_Lockit::_Lockit.LIBCPMT ref: 00A42D85
Part of subcall function 00A42D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00A42DF6

_Find_elem.LIBCPMT ref: 00A46502

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00A4633F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 0cebc443a1289d359817d73eaa65e837c79eee298774aadd1968c14e35162eaa
Instruction ID: 8edde1d19922615b0e0bc8c8e335a0bcb6d05015710aba5e6cb35e08180f881b
Opcode Fuzzy Hash: 0cebc443a1289d359817d73eaa65e837c79eee298774aadd1968c14e35162eaa
Instruction Fuzzy Hash: 85C1B978E042588FDF25DF64C9417EDBBB2BF92304F548099D849AB287DB349C85CB52

Function 00A46694 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4669E

Part of subcall function 00A3B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00A3B8DD
Part of subcall function 00A3B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00A3B900
Part of subcall function 00A3B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B928
Part of subcall function 00A3B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3B9B7

_Find_elem.LIBCPMT ref: 00A468D8

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00A46715

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 519c1280306f290c3009727e204e2ddb9e9490e5815d0e029493c285d8ba17cf
Instruction ID: 2888bccaee588c6e0e052c16f286c3e7014fc6ae7db14cdaec408e70f8c7397f
Opcode Fuzzy Hash: 519c1280306f290c3009727e204e2ddb9e9490e5815d0e029493c285d8ba17cf
Instruction Fuzzy Hash: 36C1A638E042588FDF25DF64C9417EDBBB2BF92304F548099D889AB283DB749D85CB52

Function 00A61A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A61AFD

Strings

pow, xrefs: 00A61AD5, 00A61AF2

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 324fcde32bc8a2041578c4fba722d137abb2f86e311bc224ed8ab8c8f7dd0a04
Instruction ID: 0a81ae8c6a39a5240421fef1325dfbab39c239fab81d96243bd624a8613013ae
Opcode Fuzzy Hash: 324fcde32bc8a2041578c4fba722d137abb2f86e311bc224ed8ab8c8f7dd0a04
Instruction Fuzzy Hash: 15517D71A49201CACB11B754CE113BE7FB0EB60751F388958E0D6963F8EA358CD69E87

Function 00A51E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00A51FD1

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00A51F2F, 00A51F66, 00A51F6B
-, xrefs: 00A51FFF

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: dfc93b542cd22feccfb38294034c2107f7b1789078d22a09117c68aca351f9db
Instruction ID: 2419b1b88ce5833382043b6a264cc41d306cc44cbe50cccc018d119be89b4160
Opcode Fuzzy Hash: dfc93b542cd22feccfb38294034c2107f7b1789078d22a09117c68aca351f9db
Instruction Fuzzy Hash: 0F51D270B04285AADF258F6CC885BBE7BB5BF46352F14446AEC92D7281C3748D4DC761

Function 00A3BD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A3BF6E

Strings

true, xrefs: 00A3BEAB
false, xrefs: 00A3BE95

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: df57f3961246977039df045c73900190277a0878b15d7fe75562767cfa51ebf2
Instruction ID: d9f8c1ac24cf2cfcdded9fcd64899b1c1759d24c65f738a3f8dfa47aff9cbbdf
Opcode Fuzzy Hash: df57f3961246977039df045c73900190277a0878b15d7fe75562767cfa51ebf2
Instruction Fuzzy Hash: DC51C7B5D007489FDB10DFA4C941BEEB7B8FF05304F14426AF945A7241E774A585CB61

Function 00A370A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00A37173, 00A371CE
\\?\, xrefs: 00A371E3, 00A37210

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: bbc22251974b9b750b0b78283a7e29626287592298f28e0361ca1f41f1772e62
Instruction ID: e3d288c5c508dc5ca366b4c45aa9cb99c855cc9a97d90b7a70a0dd6cd70b5675
Opcode Fuzzy Hash: bbc22251974b9b750b0b78283a7e29626287592298f28e0361ca1f41f1772e62
Instruction Fuzzy Hash: 6551D4B1E042049BDB24DFA4D946BEEB7B5FF54314F10461DF801B7290DBB56988CB90

Function 00A4D4FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4D501
_swprintf.LIBCMT ref: 00A4D573

Part of subcall function 00A4254E: __EH_prolog3.LIBCMT ref: 00A42555
Part of subcall function 00A4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00A4255F
Part of subcall function 00A4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00A425D0

Part of subcall function 00A42FC8: __EH_prolog3.LIBCMT ref: 00A42FCF

Strings

%.0Lf, xrefs: 00A4D56B

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 3050236999-1402515088
Opcode ID: 6dda3ae6f5ddee4ab8477aa356766281b488143d83e372be8438af845b1ee09d
Instruction ID: 64f5787b1955797e5ae0c21849131b9da3068cbaa33ce59a6a9a3a6549f26c70
Opcode Fuzzy Hash: 6dda3ae6f5ddee4ab8477aa356766281b488143d83e372be8438af845b1ee09d
Instruction Fuzzy Hash: D7415875D00208ABCF05EFE4CD45ADDBBB5FF98300F208549E846AB295EB359915CF91

Function 00A4D79E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4D7A5
_swprintf.LIBCMT ref: 00A4D817

Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38657
Part of subcall function 00A38610: std::_Lockit::_Lockit.LIBCPMT ref: 00A38679
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A386A1
Part of subcall function 00A38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00A3880E

Strings

%.0Lf, xrefs: 00A4D80F

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 6ec264cead17b17a903cdae920b341664c279d396b182e6f610467f25a4d5a2a
Instruction ID: 3654409df7fd264e9fbb99dd63beb375f27cdb930dc7b7830debc9f7494fb6f2
Opcode Fuzzy Hash: 6ec264cead17b17a903cdae920b341664c279d396b182e6f610467f25a4d5a2a
Instruction Fuzzy Hash: 1C415975E00208ABCF05DFE4DD45AEE7BB5FB48310F208459F845AB295EB359916CF90

Function 00A51887 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A5188E
_swprintf.LIBCMT ref: 00A51900

Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392A0
Part of subcall function 00A39270: std::_Lockit::_Lockit.LIBCPMT ref: 00A392C2
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A392EA
Part of subcall function 00A39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00A39422

Strings

%.0Lf, xrefs: 00A518F8

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 7a1b7976b2c7607d10d75e9e18cd54f1b26a4b6f20e76fcf20f7605b133a9cc4
Instruction ID: 2ca520586409b8d5e83059450e0934fffb40badb1f744abf0b5e01a19c20e5f1
Opcode Fuzzy Hash: 7a1b7976b2c7607d10d75e9e18cd54f1b26a4b6f20e76fcf20f7605b133a9cc4
Instruction Fuzzy Hash: 954147B1E00208ABCF05DFE4DD55AED7BB5FB08300F208549F856AB291DB359919CB90

Function 00A56059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00A5607E

Strings

MOC, xrefs: 00A56090
RCC, xrefs: 00A56098

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 123713a8d86e4c771714e158e7d7a5ba61f9872f6802f0f37aec221064d43899
Instruction ID: a208ab829e7e9ddf99a8a472c7078b7eae2af3bcffebdf1c4b39bce4ffee8081
Opcode Fuzzy Hash: 123713a8d86e4c771714e158e7d7a5ba61f9872f6802f0f37aec221064d43899
Instruction Fuzzy Hash: CF417872900609EFCF15DF98CD81AAEBBB5BF48305F188259FE0867252D3359954DB50

Function 00A4DF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A4DF96
__cftoe.LIBCMT ref: 00A4E01A

Strings

!%x, xrefs: 00A4DFA7

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 53bed629f0814054e21bf6de6f86aa8dedae1d9321016a39f90a71adcce0973e
Instruction ID: f931352b48a216a03dab82bb50d4f0e748c6413d70dc5cfb3c241ca9f8bd9da2
Opcode Fuzzy Hash: 53bed629f0814054e21bf6de6f86aa8dedae1d9321016a39f90a71adcce0973e
Instruction Fuzzy Hash: 84316975D0120DEBDF04EF94E981AEEB7B6FF88304F204419F805A7251DB75AA49CB64

Function 00A519FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A51A01
__cftoe.LIBCMT ref: 00A51A7F

Strings

!%x, xrefs: 00A51A15

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 9e37320664234179ee3444fc5b2d006090baa7d5fa2aae12ef9b579166e1b189
Instruction ID: 09291ec5b39c16897afa20a0b84d7e719d404f0ef7f2368493a00f98b0be99b6
Opcode Fuzzy Hash: 9e37320664234179ee3444fc5b2d006090baa7d5fa2aae12ef9b579166e1b189
Instruction Fuzzy Hash: CB31AA72D05248AFEF01DF94E881BEEBBB5FF18340F104009F944A7242D7349A49CBA0

Function 00A35F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00A35F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,9666CEAE), ref: 00A35FF6

Strings

Invalid SID, xrefs: 00A35FD4

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 28ce83337d8ee8988985f67253203f5e83ea5ddefe87408d0401f0c4f1277075
Instruction ID: fbd6829c693a8d27af8e1ef32d04db04e2b638e042d29f94c9942c06bfc44b41
Opcode Fuzzy Hash: 28ce83337d8ee8988985f67253203f5e83ea5ddefe87408d0401f0c4f1277075
Instruction Fuzzy Hash: 81219074A04605ABDB14DFA8C815BAFBBF8FF44714F10491DE406A7380D7B56A45CBD0

Function 00A39070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A3909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A390FE

Strings

bad locale name, xrefs: 00A39121

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0d6503cd83c3b908d0f1cbd16f6259e0b698ac436638faed75b343e1fac71e5e
Instruction ID: 293c59941e0a521f3738357af5e17cf034d0ef3a3bfa578abd1eb2174b8bb9fa
Opcode Fuzzy Hash: 0d6503cd83c3b908d0f1cbd16f6259e0b698ac436638faed75b343e1fac71e5e
Instruction Fuzzy Hash: 1021D570805784EED721CFA8C90474BBFF4EF19710F108A9DE49597781D3B5A604CBA1

Function 00A3F098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00A3F09F

Strings

true, xrefs: 00A3F109
false, xrefs: 00A3F0F6

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 92713a686377050fdda7a0803353accfd5dceda73b114575638508d30b3413ee
Instruction ID: b4de2a3540c411946922765482bcff5913e84b603d0ba9fea94fe0a0cba58137
Opcode Fuzzy Hash: 92713a686377050fdda7a0803353accfd5dceda73b114575638508d30b3413ee
Instruction Fuzzy Hash: FC118175D41B84AEC724EFB4D941B8AB7F4AB15300F04C52AF996DB641EB70A6448B50

Function 00A34070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,00A34261,00A74400,000000FF,9666CEAE,00000000,?,00000000,?,?,?,00A74400,000000FF,?,00A33A75,?), ref: 00A34096
LocalAlloc.KERNEL32(00000040,40000022,9666CEAE,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00A34154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,9666CEAE,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00A34177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A34217

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: a4a81fb79f75bb75f424b51e221ff3f419f8826c6844459728b3ac5963211dd5
Instruction ID: e57e752e3425a05c0b2e4ac63ceebe292b5553121b637f1642f8378b464eb5a9
Opcode Fuzzy Hash: a4a81fb79f75bb75f424b51e221ff3f419f8826c6844459728b3ac5963211dd5
Instruction Fuzzy Hash: B9519E71A006059FDB18DFA8C985AAEBBB5FB48350F14862DF929E7390D731AD41CB90

Function 00A31D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 00A31E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 00A31E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 00A31EA7
LocalFree.KERNEL32(00000001,9666CEAE,00000000,00000000,00A73C40,000000FF,?,00000000), ref: 00A31F2D

Memory Dump Source

Source File: 00000004.00000002.1771376287.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000004.00000002.1771349325.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771453580.0000000000A77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771537227.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1771656653.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a30000_MSI704E.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 8776f316c9addba5bdefa545b7bb935671498b27a03a5d5c208f68bda9da5ee5
Instruction ID: a3a15737d3ef65659e7fc3838659164549a8f58766e7f1d3daacc08725798a10
Opcode Fuzzy Hash: 8776f316c9addba5bdefa545b7bb935671498b27a03a5d5c208f68bda9da5ee5
Instruction Fuzzy Hash: 9D5104726082159FC715DF68DC80A6BB7E8FF89360F210B2EF856D7290DB31D9448B91

Analysis Process: MSI706F.tmpPID: 6340, Parent PID: 6664COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	389
Total number of Limit Nodes:	10

Executed Functions

Function 00176A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00176AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00176AD5
CloseHandle.KERNEL32(00000000), ref: 00176AF5

Strings

S-1-5-18, xrefs: 00176B69

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 1e1a0ead959cda7fc8605c065e9aabd9a4e3497870ea387306ff18d8db88b0d3
Instruction ID: 3cc43700cc189e77af617a6e190e3cd032a0b5ddf3903e0a3e7aca7c1103e215
Opcode Fuzzy Hash: 1e1a0ead959cda7fc8605c065e9aabd9a4e3497870ea387306ff18d8db88b0d3
Instruction Fuzzy Hash: DE02D270900649DFDF14DFA4C954BEEBBB5EF55314F18C258E84AAB285EB30AE05CB90

Function 00174BA0 Relevance: 36.5, APIs: 24, Instructions: 502
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001757C0: GetCurrentProcess.KERNEL32(00000008,?,E71D449C,?,-00000010), ref: 001757D0
Part of subcall function 001757C0: OpenProcessToken.ADVAPI32(00000000), ref: 001757D7

CoInitialize.OLE32(00000000), ref: 00174C15
CoCreateInstance.OLE32(001B72B0,00000000,00000004,001C5104,00000000,?), ref: 00174C45
CoUninitialize.OLE32 ref: 00175187
_com_issue_error.COMSUPP ref: 001751B5

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: c2a44355fa2369b8f6c237f8c632dda4e24319fb3d8fd0e6f7e25fb45ac8b2be
Instruction ID: 8ffd305e64f3dcc4a5c5d917415a6604f3502efd688ffa0173f27870b394f9ba
Opcode Fuzzy Hash: c2a44355fa2369b8f6c237f8c632dda4e24319fb3d8fd0e6f7e25fb45ac8b2be
Instruction Fuzzy Hash: B422A070E04388DFEF11CFA8C948BADBBB5AF55304F24819DE409EB281D7B59A45CB61

Function 001757C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,E71D449C,?,-00000010), ref: 001757D0
OpenProcessToken.ADVAPI32(00000000), ref: 001757D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 0017580C
CloseHandle.KERNEL32(?), ref: 00175822

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: fe83f8431bcfa3f9feb34e1c7bdb5d81cf5ad9fd0d68631b012da42a1d481eea
Instruction ID: 2e78fc5347aa9aae70246f8346c6ba28487e8204080f37ac4530c5fbb82d6e4e
Opcode Fuzzy Hash: fe83f8431bcfa3f9feb34e1c7bdb5d81cf5ad9fd0d68631b012da42a1d481eea
Instruction Fuzzy Hash: 1CF03074148301AFEB10AF20EC49BAA7BE8FB85700F90891EFD84C21A0D379955CDB63

Function 0017CDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(E71D449C,?,?,?,?,?,?,?,?,?,001B56D5,000000FF), ref: 0017CDE8

Part of subcall function 00171F80: LocalAlloc.KERNEL32(00000040,00000000,?,?,vector too long,00174251,E71D449C,00000000,?,00000000,?,?,?,001B4400,000000FF,?), ref: 00171F9D

ExitProcess.KERNEL32 ref: 0017CEB1

Part of subcall function 00176600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 0017667E

Strings

Full command line:, xrefs: 0017CE13

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: 5c529e867f6d16f57c0b8a606b26cb5327735a6e122a9c90eec0bf601c3ffb3c
Instruction ID: 00bafc5f8999e9fdcca74ec636b6eea48a8a8ca8a86f31465426bdf8dd34a537
Opcode Fuzzy Hash: 5c529e867f6d16f57c0b8a606b26cb5327735a6e122a9c90eec0bf601c3ffb3c
Instruction Fuzzy Hash: 9521BC71910214ABCB15FB74CC46BAE77B5AF64740F148129F40AAB2D2EF346B08C7D2

Function 00175E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00175E18,E71D449C,?), ref: 00175EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00175E18,E71D449C,?), ref: 00175EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00175E18,E71D449C,?), ref: 00175F1A

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: f5be310a2895dbc0452d796a326be0164c5d52708a2417d4c153bafa3a9bbb2f
Instruction ID: 7a6273e8e4bc456afc4c24acfa7958bb3366838fb277cd11871c47578e3d9b73
Opcode Fuzzy Hash: f5be310a2895dbc0452d796a326be0164c5d52708a2417d4c153bafa3a9bbb2f
Instruction Fuzzy Hash: C1318F71A00609AFDB14CF99CC45BAFFBF9FB44710F10852EF419A7680DBB1A9408BA0

Function 001A70BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,001A596A,00000001,00000364,?,00000006,000000FF,?,00196CE7,00000000,001A3841,00000000), ref: 001A70FC

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c18f74d0bf3d6dd90e85cf63a2f30dd9e4c8dcc3d1a8316e8306ebc47c06f81
Instruction ID: cb301121309410dc1297248dcabc87a0d89ef6189183da42d1e86c6ce7f52472
Opcode Fuzzy Hash: 2c18f74d0bf3d6dd90e85cf63a2f30dd9e4c8dcc3d1a8316e8306ebc47c06f81
Instruction Fuzzy Hash: D9F0E23930C2206A9F276B629D01B6F7B9DEF637B0B154122BC149A5D1CB20EE0186E1

Non-executed Functions

Function 0017C870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 0017CBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,001CE6D0,00000800), ref: 0017CBD3

Strings

/RunAsAdmin , xrefs: 0017C92B, 0017C94C, 0017C951
/HideWindow, xrefs: 0017C98E, 0017C9AC, 0017C9B1
/DontWait , xrefs: 0017C8D8, 0017C8EE, 0017C8F3
/EnforcedRunAsAdmin , xrefs: 0017C893, 0017C8A3, 0017C8A8
/DIR , xrefs: 0017C9F3
/LogFile, xrefs: 0017CA07

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: c593409334ba88da183828978103b41d6c9ed46df0ca6351aef3ffff7f77a874
Instruction ID: ca98c3cdea71474153a37559289f2705c5015324b525614877280b88ab553f39
Opcode Fuzzy Hash: c593409334ba88da183828978103b41d6c9ed46df0ca6351aef3ffff7f77a874
Instruction Fuzzy Hash: 66C1D2356042168ACB359F14D80177AB3F2EFA4744F69C45EE88E9B291EB70DE82C7D1

Function 001AE5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,001AE8D1,00000002,00000000,?,?,?,001AE8D1,?,00000000), ref: 001AE64C
GetLocaleInfoW.KERNEL32(?,20001004,001AE8D1,00000002,00000000,?,?,?,001AE8D1,?,00000000), ref: 001AE675
GetACP.KERNEL32(?,?,001AE8D1,?,00000000), ref: 001AE68A

Strings

ACP, xrefs: 001AE5D1
OCP, xrefs: 001AE607

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: a3ad4ee1ad28cecaa20157b2c9cd140b7676a59f300a8e4c5a88a3a23d3658fd
Instruction ID: 296101041288aa76bbcf90e8bee41cb0e9eb43007838c1d95b571d7a6745b782
Opcode Fuzzy Hash: a3ad4ee1ad28cecaa20157b2c9cd140b7676a59f300a8e4c5a88a3a23d3658fd
Instruction Fuzzy Hash: 0921B03AB00101AADB38CF58C914AD777E6AB76F64F568864E90ED7110F732DD40C750

Function 00179CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00179E60
LocalFree.KERNEL32(00000000), ref: 00179EB7
_swprintf.LIBCMT ref: 0017A0A0
LocalFree.KERNEL32(00000000), ref: 0017A0F7
_swprintf.LIBCMT ref: 0017A183

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: 8577a308a96a5c69782b4f607470ed48c993979cd57c4e3427cc4f76348a5e3e
Instruction ID: aa6356e315b5fdf627d2d5b8d9b7864ccf32547cd2b2cd7794a3ea069fea2769
Opcode Fuzzy Hash: 8577a308a96a5c69782b4f607470ed48c993979cd57c4e3427cc4f76348a5e3e
Instruction Fuzzy Hash: FCF1AC71D00219AFDF28DFA8DC40BAEBBB5FF49300F148629F915A7281D735A945CBA1

Function 001AE788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A57CC: GetLastError.KERNEL32(?,00000008,001AAD4C), ref: 001A57D0
Part of subcall function 001A57CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 001A5872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 001AE894
IsValidCodePage.KERNEL32(00000000), ref: 001AE8DD
IsValidLocale.KERNEL32(?,00000001), ref: 001AE8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001AE934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001AE953

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 19419d3c912eed6729d7d6263da50807123331dfe1533ab68b5ad112e456c5e8
Instruction ID: e01cf204c704c8a5b67527be3f3829bcd5faafe464dcfd1610a1b66de2f56fec
Opcode Fuzzy Hash: 19419d3c912eed6729d7d6263da50807123331dfe1533ab68b5ad112e456c5e8
Instruction Fuzzy Hash: CC517D79A00215AFEF20DFA5DC45ABE77F8EF5A700F154069E910E7191EB74DA40CBA0

Function 001A5D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001A5DFA

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: 4a32bb08d7ae8cb654044869a5b1959b882391ab77a8e40feadd4a046477264a
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: 26B1577A9086459FDB15CF68C881BFEBBB6EF56300F19816AE904EB341D3349D41CBA0

Function 001AB02D Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 001AB0C8
FindNextFileW.KERNEL32(00000000,?), ref: 001AB143
FindClose.KERNEL32(00000000), ref: 001AB165
FindClose.KERNEL32(00000000), ref: 001AB188

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: adaa934ff59e401f7b3a8cfb42f1e609eacf973f1765c9ddc876eb579561fc26
Instruction ID: 4837908415b621f35bae670bbeb02074997a07fc755b92b2af572272582bb982
Opcode Fuzzy Hash: adaa934ff59e401f7b3a8cfb42f1e609eacf973f1765c9ddc876eb579561fc26
Instruction Fuzzy Hash: 5741C375A04669AEDB20EFA8DDD9ABBB7B8EF86304F004195F405D7181E7309E80CB60

Function 001933A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001933B4
IsDebuggerPresent.KERNEL32 ref: 00193480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001934A0
UnhandledExceptionFilter.KERNEL32(?), ref: 001934AA

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4bbd29a418ca6c7356455c998d2ba0c3025577794feaa1b546ef3b1d485686ba
Instruction ID: 1a84aac761462cde4310ecd2906a3d05be2b00b6b2d53377900231c2c609eb53
Opcode Fuzzy Hash: 4bbd29a418ca6c7356455c998d2ba0c3025577794feaa1b546ef3b1d485686ba
Instruction Fuzzy Hash: FF314775D053189BEF11DFA4D989BCCBBB8AF08304F1041AAE50CAB290EB719B85CF45

Function 001752F0 Relevance: 52.9, APIs: 14, Strings: 16, Instructions: 402
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 0017549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 0017551D
ShellExecuteExW.SHELL32(?), ref: 00175601
ShellExecuteExW.SHELL32(?), ref: 00175637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 0017567C
GetProcAddress.KERNEL32(00000000), ref: 00175685
AllowSetForegroundWindow.USER32(00000000), ref: 0017568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 001756AB
GetProcAddress.KERNEL32(00000000), ref: 001756AE
Sleep.KERNEL32(00000064,?,?,?,?,?,?), ref: 001756CA
EnumWindows.USER32(00175830,?), ref: 001756DF
BringWindowToTop.USER32(00000000), ref: 001756F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00175711
GetExitCodeProcess.KERNEL32(?,?), ref: 0017571B

Strings

open, xrefs: 001754D5
GetProcessId, xrefs: 00175672, 001756A1
%s\System32\cmd.exe, xrefs: 001754A9
ShellExecuteInfo members:, xrefs: 00175540
Directory:<, xrefs: 001755B2
Parameters:<, xrefs: 001755C6
.bat, xrefs: 00175422
/C ""%s" %s", xrefs: 001754C1
Kernel32.dll, xrefs: 00175677, 001756A6
FilePath:<, xrefs: 00175589
Visible, xrefs: 001755DB, 001755EA
Window Visibility:, xrefs: 001755E3
.cmd, xrefs: 0017545F
Verb:<, xrefs: 0017559E
Hidden, xrefs: 001755D6
runas, xrefs: 001754EC

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectProcessSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 697762045-2796270252
Opcode ID: 185bb73bb97b9bdd37ac0c6068d31723b7f8a6d716c601a49e1c13cd108aca8c
Instruction ID: aae1a52af259b504e03ba62df402e81bed7ed41e18f2c754cc095cdf87087a7a
Opcode Fuzzy Hash: 185bb73bb97b9bdd37ac0c6068d31723b7f8a6d716c601a49e1c13cd108aca8c
Instruction Fuzzy Hash: FCE1C171A00A099BCF14DFA8C844BAEB7F6EF68714F54816DE819EB291E770AD41CB50

Function 00176600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 0017667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 001766D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 001766E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 001766FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,001B49E5,000000FF), ref: 001767DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,001B49E5,000000FF), ref: 001767E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,001B49E5), ref: 0017682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,001B49E5,000000FF), ref: 0017684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,001B49E5), ref: 00176867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,001B49E5,000000FF), ref: 00176891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 001768D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 0017692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,001B49E5,000000FF), ref: 0017695C

Strings

open, xrefs: 001768D1, 001768F0
[InternetShortcut]URL=, xrefs: 0017670A
-_.~!*'();:@&=+$,/?#[], xrefs: 00176757, 0017676E
URL Shortcut content:, xrefs: 00176875

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 44406b3aa35d51db172a7af2c5f731475b0b77691f74c1945ffdcb441839d9fc
Instruction ID: 4df5c687906c0fc277752f51f1dbd2251a8e0d90a07691e367e9e863a5c40573
Opcode Fuzzy Hash: 44406b3aa35d51db172a7af2c5f731475b0b77691f74c1945ffdcb441839d9fc
Instruction Fuzzy Hash: A0B14671904649AFEB20DF68CC86BEFBBB5EF55700F148129F508AB2C1D7709A48C7A1

Function 00192B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(001CDD3C,00000FA0,?,?,00192B6A), ref: 00192B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00192B6A), ref: 00192BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00192B6A), ref: 00192BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00192BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00192BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00192B6A), ref: 00192BF7
DeleteCriticalSection.KERNEL32(001CDD3C,00000007,?,?,00192B6A), ref: 00192C13
CloseHandle.KERNEL32(00000000,?,?,00192B6A), ref: 00192C23

Strings

SleepConditionVariableCS, xrefs: 00192BC0
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00192B9E
kernel32.dll, xrefs: 00192BAF
WakeAllConditionVariable, xrefs: 00192BCC

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 54a6bc3e69818335784546a1dd38cbb5367e21abbb2e5a220219657e04bed689
Instruction ID: 04904a7ecee81ea7480da3a0e9df877b5783f68aae970ca24dbdea16222ecacc
Opcode Fuzzy Hash: 54a6bc3e69818335784546a1dd38cbb5367e21abbb2e5a220219657e04bed689
Instruction Fuzzy Hash: 76015EB1A45211ABDA212FA9BC09EA67BA89F95B51B000926F906D25E0DF74C880C670

Function 00195CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00195DAC
type_info::operator==.LIBVCRUNTIME ref: 00195DCE
___TypeMatch.LIBVCRUNTIME ref: 00195EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00195FAF
_UnwindNestedFrames.LIBCMT ref: 00196033
CallUnexpected.LIBVCRUNTIME ref: 0019604E

Strings

csm, xrefs: 00195E05
csm, xrefs: 00195CEC
csm, xrefs: 00195D59

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7e93a8d77e4edf33333f0568162a3542ff5ebda4040d5de3a7836900b8f69b5d
Instruction ID: e31709e4f505ae37c077b9e0889e19374f618fdcd4f1bc9105fdcd70cc7f98ba
Opcode Fuzzy Hash: 7e93a8d77e4edf33333f0568162a3542ff5ebda4040d5de3a7836900b8f69b5d
Instruction Fuzzy Hash: A5B15C71800609EFCF2ADFA4C8859AEBBB6FF24324F14415AF8157B212D731DA55CBA1

Function 00174270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,E71D449C,?,?,?), ref: 001742D2
OpenProcess.KERNEL32(00000400,00000000,?,?,E71D449C,?,?,?), ref: 001742F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E71D449C,?,?,?), ref: 00174326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E71D449C,?,?,?), ref: 00174337
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 00174355
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 00174371
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 00174399
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 001743B5
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 001743D3
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 001743EF

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 478b17893d51b88cde9ad04edb0765bd18c6fb8421602d4803ba924c8aa64466
Instruction ID: 8a49e95b3fff90ca9767e0359dad62b962987580e2f9c4b4231345e08dd4043a
Opcode Fuzzy Hash: 478b17893d51b88cde9ad04edb0765bd18c6fb8421602d4803ba924c8aa64466
Instruction Fuzzy Hash: 34515D70D05228EBDB10DF98D984BEEFBB4BF49724F248219E518B72D0C7745D058BA8

Function 0018BBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018BBC4

Part of subcall function 0018254E: __EH_prolog3.LIBCMT ref: 00182555
Part of subcall function 0018254E: std::_Lockit::_Lockit.LIBCPMT ref: 0018255F
Part of subcall function 0018254E: std::_Lockit::~_Lockit.LIBCPMT ref: 001825D0

Strings

:AM:am:PM:pm, xrefs: 0018BF2A
%I : %M : %S %p, xrefs: 0018BF1F
%d / %m / %y, xrefs: 0018BEFA
%b %d %H : %M : %S %Y, xrefs: 0018BE52
%H : %M, xrefs: 0018BD03
%m / %d / %y, xrefs: 0018BCBB
%H : %M : %S, xrefs: 0018BD5D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: ef517644e5c88a7553f0a5e72dda813bb4738417ab495d7822896b34066ffc47
Instruction ID: 1f1d660c034c4f9ce4bdbfe038910de286b2e5342e247be7e54dc2ae0b902324
Opcode Fuzzy Hash: ef517644e5c88a7553f0a5e72dda813bb4738417ab495d7822896b34066ffc47
Instruction Fuzzy Hash: 59B17C7250810AAFCF19EF68CDA5EFE3BA9EB18704F154119FA06A6251D731DB10DF60

Function 00190C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00190CA4

Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792A0
Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792C2
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 001792EA
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 00179422

Strings

:AM:am:PM:pm, xrefs: 0019100A
%I : %M : %S %p, xrefs: 00190FFF
%d / %m / %y, xrefs: 00190FDA
%b %d %H : %M : %S %Y, xrefs: 00190F32
%H : %M, xrefs: 00190DE3
%m / %d / %y, xrefs: 00190D9B
%H : %M : %S, xrefs: 00190E3D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: c7e266da8444ef36539bb28065f4181fdec7531390c90f6da332e7a444e8be7d
Instruction ID: 97aea4f46d98322757057dc52abd3f1528c1583ce0d9ed7f69facd372002e70d
Opcode Fuzzy Hash: c7e266da8444ef36539bb28065f4181fdec7531390c90f6da332e7a444e8be7d
Instruction Fuzzy Hash: FEB1AC7250020AAFCF2ADFA8C959DFE3BB9EF18304F154119FA06A6251D732DA51DB60

Function 0018BF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018BF85

Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178657
Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178679
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 001786A1
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 0017880E

Strings

:AM:am:PM:pm, xrefs: 0018C2EB
%I : %M : %S %p, xrefs: 0018C2E0
%d / %m / %y, xrefs: 0018C2BB
%b %d %H : %M : %S %Y, xrefs: 0018C213
%H : %M, xrefs: 0018C0C4
%m / %d / %y, xrefs: 0018C07C
%H : %M : %S, xrefs: 0018C11E

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: d39729719478088cae8ff5c614d7a669020e767d8d955da5355bea4a7d7433e1
Instruction ID: 04e36fd9eeca59f8f3b34c062b322bbc62eab209376559a588501326a4c3724e
Opcode Fuzzy Hash: d39729719478088cae8ff5c614d7a669020e767d8d955da5355bea4a7d7433e1
Instruction Fuzzy Hash: C7B17F7650010AEFCF19EEA8C999DFA3BB9FB58344F15411AF902A2291D731DB10DFA0

Function 00188555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018855C
_Maklocstr.LIBCPMT ref: 001885C5
_Maklocstr.LIBCPMT ref: 001885D7
_Maklocchr.LIBCPMT ref: 001885EF
_Maklocchr.LIBCPMT ref: 001885FF
_Getvals.LIBCPMT ref: 00188621

Part of subcall function 00181CD4: _Maklocchr.LIBCPMT ref: 00181D03
Part of subcall function 00181CD4: _Maklocchr.LIBCPMT ref: 00181D19

Strings

true, xrefs: 001885D2
false, xrefs: 001885C0

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: ba740fdfe95ac0a3f13945dfc4eebb5ea64042d8fb08e3b4ed4b8f9d24bd0f0e
Instruction ID: e6825d074f687ef94453d21f3af26faa968b86a4661f407174ac78ed503eb4e0
Opcode Fuzzy Hash: ba740fdfe95ac0a3f13945dfc4eebb5ea64042d8fb08e3b4ed4b8f9d24bd0f0e
Instruction Fuzzy Hash: A2213BB2D00318BADF15FFA4D885ADE7BA8AF15710F10811AB915AF142EB709A41CFA1

Function 00179730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00179763

Part of subcall function 00180C94: __EH_prolog3.LIBCMT ref: 00180C9B
Part of subcall function 00180C94: std::_Lockit::_Lockit.LIBCPMT ref: 00180CA6
Part of subcall function 00180C94: std::locale::_Setgloballocale.LIBCPMT ref: 00180CC1
Part of subcall function 00180C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00180D17

std::_Lockit::_Lockit.LIBCPMT ref: 0017978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001797F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 0017984A

Part of subcall function 0017F57A: __EH_prolog3.LIBCMT ref: 0017F581

LocalFree.KERNEL32(00000000,00000000,?,001C54B1,00000000), ref: 001799BF
__cftoe.LIBCMT ref: 00179B0B

Strings

bad locale name, xrefs: 001798FF

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockitstd::locale::_$H_prolog3Lockit::_$FreeInitLocalLocimp::_Locinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3578231455-1405518554
Opcode ID: 9a09e9b378e39a5df33e223ee6fe59cf1c7013b92b5f4c89867842df29557b8f
Instruction ID: e9a046b2f0b1b2e535c2fdbcb0d698fdd883c1f3f510cbd46ea1b5b321472a8a
Opcode Fuzzy Hash: 9a09e9b378e39a5df33e223ee6fe59cf1c7013b92b5f4c89867842df29557b8f
Instruction Fuzzy Hash: 21F1A071D01249DFDF14CFA8C985BEEBBB5EF19304F148169E809AB381E7359A48CB91

Function 00173C20 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001736D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00173735
Part of subcall function 001736D0: _wcschr.LIBVCRUNTIME ref: 001737C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00173CA8
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 00173D01
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 00173D7A
ReadProcessMemory.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 00173EB1
GetLastError.KERNEL32 ref: 00173F34
FreeLibrary.KERNEL32(?), ref: 00173F7B

Strings

NtQueryInformationProcess, xrefs: 00173CA2

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: MemoryProcessRead$AddressDirectoryErrorFreeLastLibraryProcSystem_wcschr
String ID: NtQueryInformationProcess
API String ID: 566592816-2781105232
Opcode ID: f64372da408d6bd9215e0c1e2b191ed07edf285853e044c74ea50a7aa7eef502
Instruction ID: 2b6b1d756856b81b2884a147c7e17594089fa9d560d638f78b91e9cde050af83
Opcode Fuzzy Hash: f64372da408d6bd9215e0c1e2b191ed07edf285853e044c74ea50a7aa7eef502
Instruction Fuzzy Hash: 7DA15C70904659DEDB20DF64CC49BAEBBF0FF58304F24459DE449A7280EBB5AA84CF91

Function 001740B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,E71D449C,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00174154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,E71D449C,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00174177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00174217
OpenProcess.KERNEL32(00000400,00000000,?,E71D449C,?,?,?), ref: 001742D2
OpenProcess.KERNEL32(00000400,00000000,?,?,E71D449C,?,?,?), ref: 001742F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E71D449C,?,?,?), ref: 00174326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,E71D449C,?,?,?), ref: 00174337
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 00174355
CloseHandle.KERNEL32(00000000,?,E71D449C,?,?,?), ref: 00174371

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: b986c2bb4116fce66f42863f378df417dad3379db0be0a856275354aafbd777f
Instruction ID: ff8b392aa63ed8730b552560c2f53acb39d88e199d1b02d5e4d635879895e3e7
Opcode Fuzzy Hash: b986c2bb4116fce66f42863f378df417dad3379db0be0a856275354aafbd777f
Instruction Fuzzy Hash: E0819C71A002159FDB14DFA8D985BAEFBB5FB48310F248229F929A72D0D770AD408B94

Function 0019266D Relevance: 12.2, APIs: 8, Instructions: 224COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 001926F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00192786
__alloca_probe_16.LIBCMT ref: 001927B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001927F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00192812
__alloca_probe_16.LIBCMT ref: 00192838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00192875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00192892

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: e5ade0cf42021e3be28bd67befa3e044e14d612550ccbd42444b83e5dfe13af8
Instruction ID: 39f32e6c7b42bbdfd0852200c19476ec442ee573378bd7e91bd2852109ccec01
Opcode Fuzzy Hash: e5ade0cf42021e3be28bd67befa3e044e14d612550ccbd42444b83e5dfe13af8
Instruction Fuzzy Hash: 0271A076D0020ABBDF259FA4DC85AEE7BFAEF55750F290119E904B7291D731C840CBA0

Function 0019215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 001921A3
__alloca_probe_16.LIBCMT ref: 001921CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0019220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0019226A
__alloca_probe_16.LIBCMT ref: 00192287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001922C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 001922EC

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: db2c037ded3c29b1f75ca6fd886a55242252d76a9a5f93df0c2c6f4bed429014
Instruction ID: 4d08b93a67f94a6ff97f729a9de866d93130ed9884c808dbc0d18078df46d9a1
Opcode Fuzzy Hash: db2c037ded3c29b1f75ca6fd886a55242252d76a9a5f93df0c2c6f4bed429014
Instruction Fuzzy Hash: C051AE72A0020ABFEF209FA4CC45FAB7BA9FF55740F154529FA15A6190D734DD109BA0

Function 00173860 Relevance: 10.7, APIs: 7, Instructions: 227processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001738CB
CloseHandle.KERNEL32(00000000), ref: 0017390B
Process32FirstW.KERNEL32(?,00000000), ref: 0017395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 0017397A
CloseHandle.KERNEL32(00000000), ref: 00173A8E
Process32NextW.KERNEL32(?,00000000), ref: 00173AA2
CloseHandle.KERNEL32(?), ref: 00173AF0

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: d7d44cb57b7e4eed61f161d78c4419b54971cdc574a2e9c71587a41ff7edad8f
Instruction ID: b3454bfa1a93b4f73e1cefee5ee7708a17a09e00bd9b5b8dfcbae9ac39ace3bb
Opcode Fuzzy Hash: d7d44cb57b7e4eed61f161d78c4419b54971cdc574a2e9c71587a41ff7edad8f
Instruction Fuzzy Hash: 4EA13BB1905249DFDF10CFA4D988BDEBBF8BF58304F148159E819AB290D7749A44DBA0

Function 00178610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00178657
std::_Lockit::_Lockit.LIBCPMT ref: 00178679
std::_Lockit::~_Lockit.LIBCPMT ref: 001786A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,E71D449C,?,00000000), ref: 001786F9
__Getctype.LIBCPMT ref: 0017877B
std::_Facet_Register.LIBCPMT ref: 001787E4
std::_Lockit::~_Lockit.LIBCPMT ref: 0017880E

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: c3f9b618b69c2ca75bc87441b60d4d7fcf21afd6d15e474f73760936dcc14052
Instruction ID: 1daaf890e5725845107f6acb8bfcb1430654bab0400877cc577070520f710f46
Opcode Fuzzy Hash: c3f9b618b69c2ca75bc87441b60d4d7fcf21afd6d15e474f73760936dcc14052
Instruction Fuzzy Hash: AB61A171D04644DFDB11DF68C944B9ABBF4FF18314F248259E849AB391EB30AA85CB91

Function 00179270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001792A0
std::_Lockit::_Lockit.LIBCPMT ref: 001792C2
std::_Lockit::~_Lockit.LIBCPMT ref: 001792EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,E71D449C,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00179342
__Getctype.LIBCPMT ref: 001793BD
std::_Facet_Register.LIBCPMT ref: 001793F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00179422

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: e23133c5547cba0ed2826b2d0d6ea1f0746d702096383e572f08500afef0ba30
Instruction ID: 742cda0f85c37b1b0df09c55e01cd4c0850bae402b70bc110cbb4e2d116389d9
Opcode Fuzzy Hash: e23133c5547cba0ed2826b2d0d6ea1f0746d702096383e572f08500afef0ba30
Instruction Fuzzy Hash: 6151BD70904618DFCB11DF68C944BAEBBF4FF24714F208199E849AB392D770AE49CB91

Function 00193F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00193F57
___except_validate_context_record.LIBVCRUNTIME ref: 00193F5F
_ValidateLocalCookies.LIBCMT ref: 00193FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00194013
_ValidateLocalCookies.LIBCMT ref: 00194068

Strings

csm, xrefs: 00193FFD

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7a7ec88b249ab491cd90b9134936975bf8263a8f795e579648ea0f5a18bb57cf
Instruction ID: 642639570da44d8af0ebff43afe095321ba775a7ac160fee62842455febc9c15
Opcode Fuzzy Hash: 7a7ec88b249ab491cd90b9134936975bf8263a8f795e579648ea0f5a18bb57cf
Instruction Fuzzy Hash: E141B034E002099FCF14DF68C885A9EBBB5BF54328F148156F9289B392C731EE15CBA1

Function 001A72FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,001A7408,001A3841,0000000C,?,00000000,00000000,?,001A7632,00000021,FlsSetValue,001BBD58,001BBD60,?), ref: 001A73BC

Strings

api-ms-, xrefs: 001A7352
ext-ms-, xrefs: 001A7366

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ca7d9aee40dde318397c2e92b538268295c8bc42442ade7bae0ab02683a80711
Instruction ID: 5c2256de70ff7d06758028a5511b5de9a30248e49fdce51b6b16cdc3c45ffc4b
Opcode Fuzzy Hash: ca7d9aee40dde318397c2e92b538268295c8bc42442ade7bae0ab02683a80711
Instruction Fuzzy Hash: C521B739A09211EBDF22AB659C85E6A3798AF83770F260250FD15E76D0D770EE00D6E0

Function 00188969 Relevance: 9.4, APIs: 6, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00188970
ctype.LIBCPMT ref: 001889B7

Part of subcall function 0018851C: __Getctype.LIBCPMT ref: 0018852B

Part of subcall function 0018270D: __EH_prolog3.LIBCMT ref: 00182714
Part of subcall function 0018270D: std::_Lockit::_Lockit.LIBCPMT ref: 0018271E
Part of subcall function 0018270D: std::_Lockit::~_Lockit.LIBCPMT ref: 0018278F

Part of subcall function 0017F3D9: __EH_prolog3.LIBCMT ref: 0017F3E0
Part of subcall function 0017F3D9: std::_Lockit::_Lockit.LIBCPMT ref: 0017F3EA
Part of subcall function 0017F3D9: std::_Lockit::~_Lockit.LIBCPMT ref: 0017F48E

Part of subcall function 00182837: __EH_prolog3.LIBCMT ref: 0018283E
Part of subcall function 00182837: std::_Lockit::_Lockit.LIBCPMT ref: 00182848
Part of subcall function 00182837: std::_Lockit::~_Lockit.LIBCPMT ref: 001828B9

Part of subcall function 0017F3D9: Concurrency::cancel_current_task.LIBCPMT ref: 0017F499

Part of subcall function 001829F6: __EH_prolog3.LIBCMT ref: 001829FD
Part of subcall function 001829F6: std::_Lockit::_Lockit.LIBCPMT ref: 00182A07
Part of subcall function 001829F6: std::_Lockit::~_Lockit.LIBCPMT ref: 00182A78

Part of subcall function 00182961: __EH_prolog3.LIBCMT ref: 00182968
Part of subcall function 00182961: std::_Lockit::_Lockit.LIBCPMT ref: 00182972
Part of subcall function 00182961: std::_Lockit::~_Lockit.LIBCPMT ref: 001829E3

collate.LIBCPMT ref: 00188B05
numpunct.LIBCPMT ref: 00188DAF
__Getcoll.LIBCPMT ref: 00188B47

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

Part of subcall function 00176330: LocalAlloc.KERNEL32(00000040,?,00180E04,00000020,?,?,00179942,00000000,E71D449C,?,?,?,?,001B50DD,000000FF), ref: 00176336

codecvt.LIBCPMT ref: 00188E6D

Part of subcall function 00182E09: __EH_prolog3.LIBCMT ref: 00182E10
Part of subcall function 00182E09: std::_Lockit::_Lockit.LIBCPMT ref: 00182E1A
Part of subcall function 00182E09: std::_Lockit::~_Lockit.LIBCPMT ref: 00182E8B

Part of subcall function 00182F33: __EH_prolog3.LIBCMT ref: 00182F3A
Part of subcall function 00182F33: std::_Lockit::_Lockit.LIBCPMT ref: 00182F44
Part of subcall function 00182F33: std::_Lockit::~_Lockit.LIBCPMT ref: 00182FB5

Part of subcall function 001822FA: __EH_prolog3.LIBCMT ref: 00182301
Part of subcall function 001822FA: std::_Lockit::_Lockit.LIBCPMT ref: 0018230B
Part of subcall function 001822FA: std::_Lockit::~_Lockit.LIBCPMT ref: 0018237C

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID:
API String ID: 3494022857-0
Opcode ID: 5a262e6782441db582b57e36c1b6ea0c51fc2d04201e24faebed6363d9c59f14
Instruction ID: 139c82e88f1cc70d5a438ecf3496ae8e5a26de99caf011a4862b6615487142cf
Opcode Fuzzy Hash: 5a262e6782441db582b57e36c1b6ea0c51fc2d04201e24faebed6363d9c59f14
Instruction Fuzzy Hash: 8EE1B570C01215ABEB157FB48946ABF7AB5EF61750F44842DF80DA7281DF718E01DBA2

Function 0017B500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0017B531
std::_Lockit::_Lockit.LIBCPMT ref: 0017B54F
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,E71D449C,?,00000000,00000000), ref: 0017B5CF
std::_Facet_Register.LIBCPMT ref: 0017B6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B6E1

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: a5a254c51b6118a7938e499c9e843914971b3253c4ecff8dba7e9d213adaa29d
Instruction ID: f2af4d0cb4feccbd43c00ba0f6c872cf36c8f56477b1f9341a6a1dae3f20bd18
Opcode Fuzzy Hash: a5a254c51b6118a7938e499c9e843914971b3253c4ecff8dba7e9d213adaa29d
Instruction Fuzzy Hash: AE51CEB0904218DFDB12DF58C880BAEBBF4FF24314F248159E819AB391D7B5DA44CB81

Function 0017B700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0017B731
std::_Lockit::_Lockit.LIBCPMT ref: 0017B74F
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B777
LocalAlloc.KERNEL32(00000040,00000008,00000000,E71D449C,?,00000000,00000000), ref: 0017B7CF
std::_Facet_Register.LIBCPMT ref: 0017B863
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B88D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: 0fe5a5d5e9399350d86bbe880e9ef5c741fb1dd6db2a164f6de54eb9db794fe2
Instruction ID: 7db3379441c9dd4455155e4811c1156552fe4a450ea5de9d61d47ceb34cdbc3d
Opcode Fuzzy Hash: 0fe5a5d5e9399350d86bbe880e9ef5c741fb1dd6db2a164f6de54eb9db794fe2
Instruction Fuzzy Hash: 0D51BCB0908218DFCB15CF58C980BAEBBF4EF14314F24815DE859AB391D770AE45CB81

Function 001A0351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001A043B
__freea.LIBCMT ref: 001A04D1
__freea.LIBCMT ref: 001A04ED

Strings

am/pm, xrefs: 001A0551
a/p, xrefs: 001A05B5

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 4210be9587dda8806bcc2208c3ad8d52482a1f47e9d716dd17dc1dfc2049e310
Instruction ID: 8f1ba36611b5c08ecee9560b5e039e1d2d8dff9e70e3a00f3457f3327fd8a365
Opcode Fuzzy Hash: 4210be9587dda8806bcc2208c3ad8d52482a1f47e9d716dd17dc1dfc2049e310
Instruction Fuzzy Hash: 24C1F17D900206DBDB2ACFA8C988ABAB7B1FF1F704F154049E545AB251D332AD41CF61

Function 00195978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0019596F,00194900,0019358F), ref: 00195986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00195994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001959AD
SetLastError.KERNEL32(00000000,0019596F,00194900,0019358F), ref: 001959FF

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a588e5f7205f12cec812a2824dd79a77438b9911afaf567599b134432a232f00
Instruction ID: 32cac00074dd461760059283f38dcdc0cd85fccf6ecda344b0e0be2b412d237f
Opcode Fuzzy Hash: a588e5f7205f12cec812a2824dd79a77438b9911afaf567599b134432a232f00
Instruction Fuzzy Hash: F4012837209B11EFBF2627787D85E5A2B56DB2137C7200329F415A45E0FF114C4152D4

Function 00173230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,E71D449C,?,00000004), ref: 00173294
MoveFileW.KERNEL32(?,00000000), ref: 0017354A
DeleteFileW.KERNEL32(?), ref: 00173592

Part of subcall function 00171A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 00171AF7
Part of subcall function 00171A70: LocalFree.KERNEL32(7FFFFFFE), ref: 00171B7D

Part of subcall function 00172E60: LocalFree.KERNEL32(?,E71D449C,?,?,001B3C40,000000FF,?,00171242,E71D449C,?,?,001B3C75,000000FF), ref: 00172EB1

Strings

URL, xrefs: 0017328E, 0017357A
url, xrefs: 001733B9, 00173575

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: aafb276623882e5aa6257b93e756295e1b1420a0652de92668f06612f534a5df
Instruction ID: 33b5e7bc9fde70fbd02754463b780c3b8e1072670320b1e738ce9bf273cd22d2
Opcode Fuzzy Hash: aafb276623882e5aa6257b93e756295e1b1420a0652de92668f06612f534a5df
Instruction Fuzzy Hash: 92C14870D142689ADB24DF28CC98BDDBBB4BF54304F1082D9D00DA7291EBB56B88CF91

Function 001736D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00173735
GetLastError.KERNEL32(?,?,?,001B4215,000000FF), ref: 0017381A

Part of subcall function 00172310: GetProcessHeap.KERNEL32 ref: 00172365

Part of subcall function 001746F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,00173778,-00000010,?,?,?,001B4215,000000FF), ref: 00174736

_wcschr.LIBVCRUNTIME ref: 001737C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,001B4215,000000FF), ref: 001737DB

Strings

ntdll.dll, xrefs: 001737B3

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: 1829ddaa6e6baaeccd6b15129638b94d449f352532453c713605390d63233d7a
Instruction ID: 44ec9faac8b8ed2a20bf3f16d715857da24bd08859ecb24e3c882f7207c9dba4
Opcode Fuzzy Hash: 1829ddaa6e6baaeccd6b15129638b94d449f352532453c713605390d63233d7a
Instruction Fuzzy Hash: FB4190716006059FDB14DFA8CC49BAEB7B4FF14310F14862DF92A976C1EBB0AA04CB91

Function 0017621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00171A20: LocalFree.KERNEL32(?), ref: 00171A42

Part of subcall function 00193E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00171434,?,?,0017D341,00171434,001C8B5C,?,00171434,?,00000000), ref: 00193EBA

GetCurrentProcess.KERNEL32(E71D449C,E71D449C,?,?,00000000,001B4981,000000FF), ref: 001762EB

Part of subcall function 00192C98: EnterCriticalSection.KERNEL32(001CDD3C,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192CA3
Part of subcall function 00192C98: LeaveCriticalSection.KERNEL32(001CDD3C,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 001762B0
GetProcAddress.KERNEL32(00000000), ref: 001762B7

Part of subcall function 00192C4E: EnterCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C58
Part of subcall function 00192C4E: LeaveCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C8B
Part of subcall function 00192C4E: RtlWakeAllConditionVariable.NTDLL ref: 00192D02

Strings

kernel32, xrefs: 001762AB
IsWow64Process, xrefs: 001762A6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: d83b7825756e0e8c724ec63d01172887fcbb83e411642762cabf374ee7bd1747
Instruction ID: c588cb6c91cd27a1bfefd6b1618188af9a1731e7d8fbbaf325d55c3ad13704f8
Opcode Fuzzy Hash: d83b7825756e0e8c724ec63d01172887fcbb83e411642762cabf374ee7bd1747
Instruction Fuzzy Hash: 7F21E471904655EFCF10DFA4DD06F9DB7B8FB28B10F104229F815A3AD0EB74A940CA51

Function 00188451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00188458
_Getvals.LIBCPMT ref: 001884AA
_Mpunct.LIBCPMT ref: 001884E5
_Mpunct.LIBCPMT ref: 001884FF

Strings

$+xv, xrefs: 0018850A

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: d14166e7f3a81a4b2d15301f3cef24a1b36b14f8457f09c3a1cd58c7e68d8cbc
Instruction ID: ed76080a7c2569d0f18833dc5be7f57ab2f805d7c57d2018f3cb330038a97087
Opcode Fuzzy Hash: d14166e7f3a81a4b2d15301f3cef24a1b36b14f8457f09c3a1cd58c7e68d8cbc
Instruction Fuzzy Hash: 8C2160B1904B92AEDB25EF74849077BBEF8AB19310F04495AE459C7A42D774E701CFA0

Function 00176250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(E71D449C,E71D449C,?,?,00000000,001B4981,000000FF), ref: 001762EB

Part of subcall function 00192C98: EnterCriticalSection.KERNEL32(001CDD3C,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192CA3
Part of subcall function 00192C98: LeaveCriticalSection.KERNEL32(001CDD3C,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 001762B0
GetProcAddress.KERNEL32(00000000), ref: 001762B7

Part of subcall function 00192C4E: EnterCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C58
Part of subcall function 00192C4E: LeaveCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C8B
Part of subcall function 00192C4E: RtlWakeAllConditionVariable.NTDLL ref: 00192D02

Strings

kernel32, xrefs: 001762AB
IsWow64Process, xrefs: 001762A6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: 210aa0bb819cdb346ec54143f64b807a9965ab9d34a1d065642704e0d5b81a8e
Instruction ID: b7fddce46ca769a306d1fd44b09c872053406fadcf70f473fdbd91cd270321a1
Opcode Fuzzy Hash: 210aa0bb819cdb346ec54143f64b807a9965ab9d34a1d065642704e0d5b81a8e
Instruction Fuzzy Hash: 7E11A2B2D08A54DFDB10CF54DD45F99B7F8F728B10F00426AE81593BD0E775A940CA51

Function 001969E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00196AA3,?,?,001CDDCC,00000000,?,00196BCE,00000004,InitializeCriticalSectionEx,001B97E8,InitializeCriticalSectionEx,00000000), ref: 00196A72

Strings

api-ms-, xrefs: 00196A32

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8504eb603ad234a3afebc27616ce7c651d6ff8c807f55744f21bc318d538dda0
Instruction ID: e545c9310ede91e57e1518c31cb5486a11cbd8799fb199d00cb11ffc98b847d1
Opcode Fuzzy Hash: 8504eb603ad234a3afebc27616ce7c651d6ff8c807f55744f21bc318d538dda0
Instruction Fuzzy Hash: 0111E532E04225ABCF229B689C45B5D37E49F42770F254260FA15FB2C0D770EE4086F5

Function 001A2DEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E71D449C,?,?,00000000,001B6A6C,000000FF,?,001A2DC1,?,?,001A2D95,?), ref: 001A2E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001A2E35
FreeLibrary.KERNEL32(00000000,?,00000000,001B6A6C,000000FF,?,001A2DC1,?,?,001A2D95,?), ref: 001A2E57

Strings

CorExitProcess, xrefs: 001A2E2D
mscoree.dll, xrefs: 001A2E1C

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e769a8f707db8173812d02dcab761367e6519bbda19d4fe8158a6b40bb42e44d
Instruction ID: 311346a41eba808795862e777f8bd127b6f2a1dc8509b42c1de8d7229236e156
Opcode Fuzzy Hash: e769a8f707db8173812d02dcab761367e6519bbda19d4fe8158a6b40bb42e44d
Instruction Fuzzy Hash: E701D676A08619EFCB128F54CC05FFFBBB8FB48B10F000629F811A26E0DB759940CA90

Function 001A6DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001A6E40
__alloca_probe_16.LIBCMT ref: 001A6F01
__freea.LIBCMT ref: 001A6F68

Part of subcall function 001A5BDC: HeapAlloc.KERNEL32(00000000,00000000,001A3841,?,001A543A,?,00000000,?,00196CE7,00000000,001A3841,00000000,?,?,?,001A363B), ref: 001A5C0E

__freea.LIBCMT ref: 001A6F7D
__freea.LIBCMT ref: 001A6F8D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: dd004d643a036f24f94b76d9eb166eb74039989adfb7a71a78f49896ecf62cc9
Instruction ID: 4f843409c97f0f050fb0d15be7a3e19cae9591680915b14662a2c9d31d7d3cb1
Opcode Fuzzy Hash: dd004d643a036f24f94b76d9eb166eb74039989adfb7a71a78f49896ecf62cc9
Instruction Fuzzy Hash: 4D51C17A600216AFEF259FA4DC91EBF3AA9EF1A750B190129FD08D7251E735CD10C7A0

Function 0017B8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0017B8DD
std::_Lockit::_Lockit.LIBCPMT ref: 0017B900
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B928
std::_Facet_Register.LIBCPMT ref: 0017B98D
std::_Lockit::~_Lockit.LIBCPMT ref: 0017B9B7

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 8cd308b1a2fc553c770a5d09887f01703d53be456bc884e87996b6c124dde85a
Instruction ID: 60226fe155210ebe75e67a962e9a4e471e602dd0c6b0a2d31ca3c34d1723cd70
Opcode Fuzzy Hash: 8cd308b1a2fc553c770a5d09887f01703d53be456bc884e87996b6c124dde85a
Instruction Fuzzy Hash: AB31E771904218DFCB11DF58D980BAEBBF4EF24328F148199EA18673A1D731AE45CB91

Function 00175890 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,75EF4450,00175646,?,?,?,?,?), ref: 00175898

Strings

false, xrefs: 001758A2
true, xrefs: 001758A7, 001758B6
Last error=, xrefs: 001758D9
Call to ShellExecuteEx() returned:, xrefs: 001758AF

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: afde9ee2cc17227d4246813ad35914d799bf881e500808739e87e0afbd38cb29
Instruction ID: 33bb988744884d4a3d1e25f9eb53955fdc6658e469c453e67a50f48a94e00584
Opcode Fuzzy Hash: afde9ee2cc17227d4246813ad35914d799bf881e500808739e87e0afbd38cb29
Instruction Fuzzy Hash: 7A117C16A10621C7CB301F6D980072AA2F6EF64758F65447EE989A7391EBB58CC18395

Function 00181C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00181C62
_Maklocstr.LIBCPMT ref: 00181C7F
_Maklocstr.LIBCPMT ref: 00181C9C
_Maklocchr.LIBCPMT ref: 00181CAE
_Maklocchr.LIBCPMT ref: 00181CC1

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 9fd6c843a20033ecde6682765710fe712cc633a870656aa5713ee4cc25d27043
Instruction ID: 49836d64b5f45cf88dd1f750c9ab3ddd58a1cca82d2b551a3c6324886493843a
Opcode Fuzzy Hash: 9fd6c843a20033ecde6682765710fe712cc633a870656aa5713ee4cc25d27043
Instruction Fuzzy Hash: E6119EB2940B84BFE720EBA5C881F52B7ECAF14750F084919F645CBA41D364FE518BA5

Function 0017D87C Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017D883
std::_Lockit::_Lockit.LIBCPMT ref: 0017D88D

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

numpunct.LIBCPMT ref: 0017D8C7
std::_Facet_Register.LIBCPMT ref: 0017D8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 0017D8FE

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 9bb3efe15d573743337b5cdffd1fdc02903a28b87e3e632a2587c2dae15f2297
Instruction ID: 6ac035da93b7c88c98dd04bbf3eb8813b4e25f73b62ec359c33fbf337f631203
Opcode Fuzzy Hash: 9bb3efe15d573743337b5cdffd1fdc02903a28b87e3e632a2587c2dae15f2297
Instruction Fuzzy Hash: B911ED3590021A9BCF06FBA4E801ABE7B71AFA4714F24845DF519AB2D1CF309E058B92

Function 0018238F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182396
std::_Lockit::_Lockit.LIBCPMT ref: 001823A0

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

codecvt.LIBCPMT ref: 001823DA
std::_Facet_Register.LIBCPMT ref: 001823F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00182411

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 0cc2a762be09e0f8dbf234eb6370ecef536c58757d2f98d67223ed88504be9e9
Instruction ID: fb6fb939e7badd2c7bdc4cfff8be2eb549a2c8977c2a8dc108827337a8c2af31
Opcode Fuzzy Hash: 0cc2a762be09e0f8dbf234eb6370ecef536c58757d2f98d67223ed88504be9e9
Instruction Fuzzy Hash: 6D010C35A002198BCB06FB649805ABE77B1AFA4B10F244519F4147B292DF74DF44CFA0

Function 00182424 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018242B
std::_Lockit::_Lockit.LIBCPMT ref: 00182435

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

collate.LIBCPMT ref: 0018246F
std::_Facet_Register.LIBCPMT ref: 00182486
std::_Lockit::~_Lockit.LIBCPMT ref: 001824A6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 3152f1f19e0dee2db0f491ed546b394826f77263cc1fe2974c59327290c80b77
Instruction ID: 38f251fd48a48808b1ed93453f4420b7c8ff247035d9b3ae156e07f275dab5f9
Opcode Fuzzy Hash: 3152f1f19e0dee2db0f491ed546b394826f77263cc1fe2974c59327290c80b77
Instruction Fuzzy Hash: 8301CC35900219DBCB06FBA4E805AAEBBB1AFA4720F244409F4156B2D2DF709F45CFA0

Function 001824B9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001824C0
std::_Lockit::_Lockit.LIBCPMT ref: 001824CA

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

collate.LIBCPMT ref: 00182504
std::_Facet_Register.LIBCPMT ref: 0018251B
std::_Lockit::~_Lockit.LIBCPMT ref: 0018253B

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: c1207ba15e21e8675c2a4e44162b403654399b06f00618daa461954b93cc703e
Instruction ID: 3ee6edc54796089124a330afc4dcae3ff9a3f34ad85667169f8c24a3a120aefc
Opcode Fuzzy Hash: c1207ba15e21e8675c2a4e44162b403654399b06f00618daa461954b93cc703e
Instruction Fuzzy Hash: 4B01DE35900219DBCB0AFB64E849AAEB7B1AFA4B20F244409F414AB2D1CF30DF448F90

Function 0018254E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182555
std::_Lockit::_Lockit.LIBCPMT ref: 0018255F

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

ctype.LIBCPMT ref: 00182599
std::_Facet_Register.LIBCPMT ref: 001825B0
std::_Lockit::~_Lockit.LIBCPMT ref: 001825D0

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: dd010a4f98b7d555e881ccb8fe08d828bfdb558a335848863f034327572d199d
Instruction ID: 23bbc8ad0d0d6a856bc1a74923e308e30a0f56e2d840c0ec0a6bbd2df39304ef
Opcode Fuzzy Hash: dd010a4f98b7d555e881ccb8fe08d828bfdb558a335848863f034327572d199d
Instruction Fuzzy Hash: 6001CC359002199BCB16FB64D815AAEBBB1AFA8720F244519F425AB2D2DF70DF44CF90

Function 001825E3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001825EA
std::_Lockit::_Lockit.LIBCPMT ref: 001825F4

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

messages.LIBCPMT ref: 0018262E
std::_Facet_Register.LIBCPMT ref: 00182645
std::_Lockit::~_Lockit.LIBCPMT ref: 00182665

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 4a650ee7facc8c1ee8e84e526fac5e193635abe714efc1eae0737fe3e9e24c3f
Instruction ID: 221eb0dd49acb440b5d908bc273b8da7ac5ecee88d6f56800fcb4c79a21ae396
Opcode Fuzzy Hash: 4a650ee7facc8c1ee8e84e526fac5e193635abe714efc1eae0737fe3e9e24c3f
Instruction Fuzzy Hash: 3601DE359002199BCB16FBA4E815AAEBBB1BFA4710F24450AF8146B2D2DF709F05CF90

Function 00182678 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018267F
std::_Lockit::_Lockit.LIBCPMT ref: 00182689

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

messages.LIBCPMT ref: 001826C3
std::_Facet_Register.LIBCPMT ref: 001826DA
std::_Lockit::~_Lockit.LIBCPMT ref: 001826FA

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 5d1be01b734832030a166b89172077ecd6fc4ed34ba0e9c28f9f57c7ece77b86
Instruction ID: 3605576a7fb99566534a2d1edeed360f2e2430a99265d4a8481b1f2ade78d546
Opcode Fuzzy Hash: 5d1be01b734832030a166b89172077ecd6fc4ed34ba0e9c28f9f57c7ece77b86
Instruction Fuzzy Hash: EE01CC359006199FCB06FB64D805AAE77B1AFA8720F244449F9146B292DF709F058F90

Function 0018E843 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018E84A
std::_Lockit::_Lockit.LIBCPMT ref: 0018E854

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

collate.LIBCPMT ref: 0018E88E
std::_Facet_Register.LIBCPMT ref: 0018E8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 0018E8C5

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: f6c7282c51ed4826a384bf0d91917ade6c80752ce8dd8f262e165ebcdbda3128
Instruction ID: b8a8270a534a674fc673961b08272e7a15cc6d40a4f50ae1d29a7c2e5c67fac8
Opcode Fuzzy Hash: f6c7282c51ed4826a384bf0d91917ade6c80752ce8dd8f262e165ebcdbda3128
Instruction Fuzzy Hash: 36019235900129DFCB05FB64D806AAE77B1BFA5710F248519F8156B2D1CF749F048F91

Function 0018E8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018E8DF
std::_Lockit::_Lockit.LIBCPMT ref: 0018E8E9

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

messages.LIBCPMT ref: 0018E923
std::_Facet_Register.LIBCPMT ref: 0018E93A
std::_Lockit::~_Lockit.LIBCPMT ref: 0018E95A

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 0782cea144928a77096dbed52ef1524e4002014c934e304c84bcbe68857e10ec
Instruction ID: 3a8a283da8081bddfa82d7bf2fbdd77f9a94a40bf6a52cae0b9ff3a8f38a3e58
Opcode Fuzzy Hash: 0782cea144928a77096dbed52ef1524e4002014c934e304c84bcbe68857e10ec
Instruction Fuzzy Hash: C8018C359002199BCB16FB649845ABE7BB1BFA4714F254509F818AB292CF749F04CF91

Function 00182961 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182968
std::_Lockit::_Lockit.LIBCPMT ref: 00182972

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 001829AC
std::_Facet_Register.LIBCPMT ref: 001829C3
std::_Lockit::~_Lockit.LIBCPMT ref: 001829E3

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: fb30b7a6796d0e2f4996095a82cf522089a1dbde5c683d65d4bb1f6fdfbd9fb2
Instruction ID: 2c0c3c89659f88cd443d23428605be6f01eac44059f0e4356c75fb47a9b03a8f
Opcode Fuzzy Hash: fb30b7a6796d0e2f4996095a82cf522089a1dbde5c683d65d4bb1f6fdfbd9fb2
Instruction Fuzzy Hash: 2D01D235900129DBCB06FB64D806AAE77B1AFA8714F254549F424672D2CF709F048F91

Function 001829F6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001829FD
std::_Lockit::_Lockit.LIBCPMT ref: 00182A07

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 00182A41
std::_Facet_Register.LIBCPMT ref: 00182A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00182A78

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: b37f7570041d566e61aeb2026fa8b9a3e0ca5ad8a61f044e3eea55fcf4479f0e
Instruction ID: d12116ffa232db445ee867728e745d764ae684948a032b07aa1253e45f6803d4
Opcode Fuzzy Hash: b37f7570041d566e61aeb2026fa8b9a3e0ca5ad8a61f044e3eea55fcf4479f0e
Instruction Fuzzy Hash: C501DE35900229DFCB1AFB64D845ABEB7B1AFA8710F264509F8156B2D2CF709F458F90

Function 0018EA97 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018EA9E
std::_Lockit::_Lockit.LIBCPMT ref: 0018EAA8

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 0018EAE2
std::_Facet_Register.LIBCPMT ref: 0018EAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0018EB19

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: d9327b0443f596b1f8d7a4a2f06ea0037637ef3db41f5a18ecf2e1460bf6255e
Instruction ID: 77ce0f9ed750637e43d9866db71497411ba0401e5fa964f1fa3bdf652062c655
Opcode Fuzzy Hash: d9327b0443f596b1f8d7a4a2f06ea0037637ef3db41f5a18ecf2e1460bf6255e
Instruction Fuzzy Hash: 8101CC36A002199BCB16FB649805AAE77B1BFA4720F244509F4296B2D2CF30DF048F91

Function 00182A8B Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182A92
std::_Lockit::_Lockit.LIBCPMT ref: 00182A9C

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 00182AD6
std::_Facet_Register.LIBCPMT ref: 00182AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00182B0D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 9f0e5366aa948a78dace4b649113240cc699d64e2cc8f61da7d638b74cfc449a
Instruction ID: 6ea94db37fc50313bf55db55890c2438e12cfc79369d24e02f690c5d146c8acc
Opcode Fuzzy Hash: 9f0e5366aa948a78dace4b649113240cc699d64e2cc8f61da7d638b74cfc449a
Instruction Fuzzy Hash: 3101CC369002199FCB16FF649805AAE77B1AFA4720F244809F914AB2D2CF749F04CF91

Function 0018EB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018EB33
std::_Lockit::_Lockit.LIBCPMT ref: 0018EB3D

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 0018EB77
std::_Facet_Register.LIBCPMT ref: 0018EB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 0018EBAE

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 11409f2325f06929444f8929a8fc77a96e3101fe9e07b2255c4b5e01f9f98d7a
Instruction ID: bc6cda2cfd32e521e53d51df23acd45ad002df74c0fca267de8bcb009d2d14aa
Opcode Fuzzy Hash: 11409f2325f06929444f8929a8fc77a96e3101fe9e07b2255c4b5e01f9f98d7a
Instruction Fuzzy Hash: E501CC35900119DFCB16FB64D885AAEB7B1AFA8710F254409F4156B2D2CF709F058F91

Function 00182B20 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182B27
std::_Lockit::_Lockit.LIBCPMT ref: 00182B31

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

moneypunct.LIBCPMT ref: 00182B6B
std::_Facet_Register.LIBCPMT ref: 00182B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00182BA2

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 6f63e3d4e883ba97dba2bab54023e572eed4619d4574be605243306099c6ade1
Instruction ID: 5021c7323fcacc123b3cb064aba19f129064192f67fe98bf8bb04085416e33f5
Opcode Fuzzy Hash: 6f63e3d4e883ba97dba2bab54023e572eed4619d4574be605243306099c6ade1
Instruction Fuzzy Hash: FC01D235901219DBCB16FF64D845AAE7771BFA4720F244409F514672D2DF309F448F91

Function 00182D74 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00182D85

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

numpunct.LIBCPMT ref: 00182DBF
std::_Facet_Register.LIBCPMT ref: 00182DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00182DF6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: f2978e88e77e2371cae6dc152e7c18686f5cde20db5cea5828384e606e9e4331
Instruction ID: b8adcc77cc07f00a66208db8edeadf1f7c97bb9df121aa12aafe97bf044e08df
Opcode Fuzzy Hash: f2978e88e77e2371cae6dc152e7c18686f5cde20db5cea5828384e606e9e4331
Instruction Fuzzy Hash: 1A01CC369002199BCB06FBA4D805ABE7BB1BFA4710F254909F414AB292CF749F05CF90

Function 00192C4E Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C58
LeaveCriticalSection.KERNEL32(001CDD3C,?,?,00172427,001CE638,001B6B40), ref: 00192C8B
RtlWakeAllConditionVariable.NTDLL ref: 00192D02
SetEvent.KERNEL32(?,00172427,001CE638,001B6B40), ref: 00192D0C
ResetEvent.KERNEL32(?,00172427,001CE638,001B6B40), ref: 00192D18

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 3199273ffb2b6748ce03479fb771a31f354e49e63b5f5a8cbf6f4ab21962ff5b
Instruction ID: 160a88c27ce887452d05e2ed3ab79aec72e9be4c9ad49bd98c2a84992072af1b
Opcode Fuzzy Hash: 3199273ffb2b6748ce03479fb771a31f354e49e63b5f5a8cbf6f4ab21962ff5b
Instruction Fuzzy Hash: 8701F675905120DFCB15AF98FC48EA9BBB5FB89751701046AF90697BA0CB309DC2DBE0

Function 0017BB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,E71D449C,?,00000000), ref: 0017BBA3
Concurrency::cancel_current_task.LIBCPMT ref: 0017BD7F

Strings

true, xrefs: 0017BCAB
false, xrefs: 0017BC95

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: 491e22d5ebf446273e1ef9047d73bd63eb1dda90eb1677aece8d5928d1f84b37
Instruction ID: 090166f0d095444e8b7e586486cf037ba8120bf1f57f2c13dc845faa9b31117a
Opcode Fuzzy Hash: 491e22d5ebf446273e1ef9047d73bd63eb1dda90eb1677aece8d5928d1f84b37
Instruction Fuzzy Hash: 726192B1D00748DBDB10DFA4C941BDEBBF8FF14704F14826AE855AB281E775AA84CB91

Function 0018D3CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018D3D2

Part of subcall function 0018254E: __EH_prolog3.LIBCMT ref: 00182555
Part of subcall function 0018254E: std::_Lockit::_Lockit.LIBCPMT ref: 0018255F
Part of subcall function 0018254E: std::_Lockit::~_Lockit.LIBCPMT ref: 001825D0

_Find_elem.LIBCPMT ref: 0018D46E

Strings

%.0Lf, xrefs: 0018D419
0123456789-, xrefs: 0018D41E

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 166ad77e39f8fa226e36e1f77bba0b723cc342a23bb9b243b8e4ba794d193feb
Instruction ID: 46e93b54eac8137cf21aefdc5b80569a59ef67aae717da653d5c30fc2cb32e90
Opcode Fuzzy Hash: 166ad77e39f8fa226e36e1f77bba0b723cc342a23bb9b243b8e4ba794d193feb
Instruction Fuzzy Hash: 87414B31900218DFCF15EFA4D881AEEBBB5FF58314F500159E815AB295DB30AA56CFA1

Function 0018D66F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018D676

Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178657
Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178679
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 001786A1
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 0017880E

_Find_elem.LIBCPMT ref: 0018D712

Strings

0123456789-, xrefs: 0018D6C2
0123456789-, xrefs: 0018D6BD

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 2cd634e764c19049142f075191ad0366bbaa356ed3480ebdf42ca6b4b44c1f7f
Instruction ID: 473a05f323a270d6b9d03b70f163e8552ffe54136eec6fb9c67c4bed1ebafc0a
Opcode Fuzzy Hash: 2cd634e764c19049142f075191ad0366bbaa356ed3480ebdf42ca6b4b44c1f7f
Instruction Fuzzy Hash: B4416A31900218DFCF15EFA8D880AEEBBB5FF18314F500199F815AB295DB309A56CFA1

Function 0019175A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00191761

Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792A0
Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792C2
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 001792EA
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 00179422

_Find_elem.LIBCPMT ref: 001917FB

Strings

0123456789-, xrefs: 001917A8
0123456789-, xrefs: 001917AD

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 150c034d95e688f40a9df313e181b783c87fe65ceafbc27ca964d4b0c9f2858a
Instruction ID: 7a51aee7de3f163f51ec11f5d67cd65e3cf7f481c6c2d279587ef1ca7213b183
Opcode Fuzzy Hash: 150c034d95e688f40a9df313e181b783c87fe65ceafbc27ca964d4b0c9f2858a
Instruction Fuzzy Hash: AA416D3190020AEFCF05EFA4D891AEEBBB5FF14314F10415AF811AB252DB35EA46DB91

Function 00188386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018838D

Part of subcall function 00181C42: _Maklocstr.LIBCPMT ref: 00181C62
Part of subcall function 00181C42: _Maklocstr.LIBCPMT ref: 00181C7F
Part of subcall function 00181C42: _Maklocstr.LIBCPMT ref: 00181C9C
Part of subcall function 00181C42: _Maklocchr.LIBCPMT ref: 00181CAE
Part of subcall function 00181C42: _Maklocchr.LIBCPMT ref: 00181CC1

_Mpunct.LIBCPMT ref: 0018841A
_Mpunct.LIBCPMT ref: 00188434

Strings

$+xv, xrefs: 0018843F

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: e4f781e93b7b2f6298f3846e5c788077125ee0c84bdd8471de746c88435612ab
Instruction ID: e1c1739798649b42d37ce8fa38395b6d72289e654ded9b28fc62663d232b28f6
Opcode Fuzzy Hash: e4f781e93b7b2f6298f3846e5c788077125ee0c84bdd8471de746c88435612ab
Instruction Fuzzy Hash: 9F2162B1904B92AEDB25EF75849077BBEF8BB18700F04455AE499C7A42D734E702CF90

Function 0018FFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018FFF1
_Mpunct.LIBCPMT ref: 0019007E
_Mpunct.LIBCPMT ref: 00190098

Strings

$+xv, xrefs: 001900A3

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: ad6f2aff8252a4122cd9a11c9e02b0d8082d30b3f2eb61111dae949318d32135
Instruction ID: b98acb67ea30a2162dac9076d9bcdd442a237550cbfb9529c4acaea38690747d
Opcode Fuzzy Hash: ad6f2aff8252a4122cd9a11c9e02b0d8082d30b3f2eb61111dae949318d32135
Instruction Fuzzy Hash: E62192B1904B516EDB26DF75889077BBEF8AB1C300F18461AF099C7A42D734E601CF90

Function 001724C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00171434,?,00000000), ref: 00172569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00171434,?,00000000), ref: 00172589
LocalFree.KERNEL32(?,00171434,?,00000000), ref: 001725DF
CloseHandle.KERNEL32(00000000,E71D449C,?,00000000,001B3C40,000000FF,00000008,?,?,?,?,00171434,?,00000000), ref: 00172633
LocalFree.KERNEL32(?,E71D449C,?,00000000,001B3C40,000000FF,00000008,?,?,?,?,00171434), ref: 00172647

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: 7ba1dafe7d93745b9b06bfd03ae8658185e2d272fc02dc08d92ab5647e54895d
Instruction ID: 78ec9f4d53c6493183185e2121a1b218f9f4025948216bc5925f8802f2204647
Opcode Fuzzy Hash: 7ba1dafe7d93745b9b06bfd03ae8658185e2d272fc02dc08d92ab5647e54895d
Instruction Fuzzy Hash: 25411C726043119BC7149F78DC94AAAB7F9EF49360F10872AF52AC76D0DB30ED4687A0

Function 001B1D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E71D449C,?,00000000,?), ref: 001B1DFE

Part of subcall function 001AA9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,001A6F5E,?,00000000,-00000008), ref: 001AAA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001B2059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001B20A1
GetLastError.KERNEL32 ref: 001B2144

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5a7ab944be64c5999bf889e3ffffa8943316d56f17577d7d564706efe8828022
Instruction ID: c340c75b31a4860a9e7c886a6501183de84c66a2012dd6d3a0f5cb8fe7fc2bab
Opcode Fuzzy Hash: 5a7ab944be64c5999bf889e3ffffa8943316d56f17577d7d564706efe8828022
Instruction Fuzzy Hash: DCD168B5D00248AFCF15CFA8D890AEEBBB5FF09314F18466AE925EB251D730A945CF50

Function 00190116 Relevance: 6.3, APIs: 4, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0019011D
collate.LIBCPMT ref: 00190126

Part of subcall function 0018EDF2: __EH_prolog3_GS.LIBCMT ref: 0018EDF9
Part of subcall function 0018EDF2: __Getcoll.LIBCPMT ref: 0018EE5D

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

__Getcoll.LIBCPMT ref: 0019016C
numpunct.LIBCPMT ref: 001903C4

Part of subcall function 00176330: LocalAlloc.KERNEL32(00000040,?,00180E04,00000020,?,?,00179942,00000000,E71D449C,?,?,?,?,001B50DD,000000FF), ref: 00176336

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 259100098-0
Opcode ID: f6b8af86dccfd20ab44b68a34613c776db33330645c29e858f6fa02d5680d47e
Instruction ID: 37aca0e9208ec9b6e6e9d93e16865c8dcc7ed7773e6ae800bc395673ddd68060
Opcode Fuzzy Hash: f6b8af86dccfd20ab44b68a34613c776db33330645c29e858f6fa02d5680d47e
Instruction Fuzzy Hash: 2891C371D01211AFEB257BB58D46B7F7AB8EF65760F10842DF81DA7281DB708A01C7A2

Function 00195A58 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00195B1F
___AdjustPointer.LIBCMT ref: 00195B42
___AdjustPointer.LIBCMT ref: 00195BDE

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 309e5309fa81660e0b2304da898640b8db46d75bcf570299f03689f46804cb4a
Instruction ID: 3dac976a76ed164b70e519d3afec6f72df99a29589d5c7a427ef6a2f6de4198f
Opcode Fuzzy Hash: 309e5309fa81660e0b2304da898640b8db46d75bcf570299f03689f46804cb4a
Instruction Fuzzy Hash: 8B51F472A01B069FDF2A8F54D851BBA77B7EF50314F14462DE906A72A1E731EC80C794

Function 001A24E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577a0dc51235d9a8f37a4d1fc9e9eb56093b8c7d6dc0882be9639f557f99a702
Instruction ID: 9c79fd7b377d77ec6d7e57a3423fd68858b99855e295657e92b360f17b4b9e97
Opcode Fuzzy Hash: 577a0dc51235d9a8f37a4d1fc9e9eb56093b8c7d6dc0882be9639f557f99a702
Instruction Fuzzy Hash: C521F079A04205AFDF24AF79DC65CAB77A8FF56364B008915FC15D7290EB30ED0097A0

Function 00176FB0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 00176FB7

Strings

Call to ShellExecute() for verb<, xrefs: 00176FC1
Last error=, xrefs: 00177011
> returned:, xrefs: 00176FC6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: ad41bb0c4952a475c1a8a7e051441f79f076d24a7343118b153c608bbc0a134c
Instruction ID: c10b036afff5a260598d0f2f2382e0897cf27e32ac07620aeaabe61084e96a3b
Opcode Fuzzy Hash: ad41bb0c4952a475c1a8a7e051441f79f076d24a7343118b153c608bbc0a134c
Instruction Fuzzy Hash: 83219F59A1066182CB301F389411739A2F1FF64B54F64586FE8CDD7381EBA98CC283A1

Function 0017F3D9 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017F3E0
std::_Lockit::_Lockit.LIBCPMT ref: 0017F3EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0017F48E
Concurrency::cancel_current_task.LIBCPMT ref: 0017F499

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: 5267768c589ec2bae7f716cd870949e13ff48ef9e7b1800861e1846096331eeb
Instruction ID: b7f4bf469d89a28bf2e3dc4f68c3dedc3390ac3e3e8105f969697d6a35e40df5
Opcode Fuzzy Hash: 5267768c589ec2bae7f716cd870949e13ff48ef9e7b1800861e1846096331eeb
Instruction Fuzzy Hash: 1D212C34A0061AEFCB14EF14C851A6EB7B1FF48710F118569E91AAB7A1CB70EE51CF80

Function 0017CCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,E71D449C), ref: 0017CD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0017CD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0017CD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0017CD86

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 6121252853899c1bbd34c76ad3c574c6a4ded5896a4edcdeaf4bbe6c54bbbff9
Instruction ID: b36a4a06efd7fd6544f46c3011296094f1dcad4f1d46c208831efe677d89e494
Opcode Fuzzy Hash: 6121252853899c1bbd34c76ad3c574c6a4ded5896a4edcdeaf4bbe6c54bbbff9
Instruction Fuzzy Hash: 1B21B170945314ABD7209F54DC49FAABBB8EB45B24F20422AF504BB6D0D7B06A0487E4

Function 001822FA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182301
std::_Lockit::_Lockit.LIBCPMT ref: 0018230B

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018235C
std::_Lockit::~_Lockit.LIBCPMT ref: 0018237C

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 3606153080e5b2134632749dfdd65c0ba5d8bbd1bdebeda40c4e7470002f7a72
Instruction ID: 3244ceede7770d32bf98da2e8826cdc5a69b6586781cd5b720f99fb483c097d7
Opcode Fuzzy Hash: 3606153080e5b2134632749dfdd65c0ba5d8bbd1bdebeda40c4e7470002f7a72
Instruction Fuzzy Hash: 1A01C035900219DFCB06FB64E816AAEB771BFA8710F244519F914AB2D1CF749F448F90

Function 0017D6BD Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017D6C4
std::_Lockit::_Lockit.LIBCPMT ref: 0017D6CE

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0017D71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0017D73F

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 965aef07910e8d17ed9e4a11678a0071bb6aa458f3d570315d1695418f1e8610
Instruction ID: 957f28749f10fc0c8d845ca31ff7f106ddc3566b88b0f02b7d0f9dea2d7a4f1e
Opcode Fuzzy Hash: 965aef07910e8d17ed9e4a11678a0071bb6aa458f3d570315d1695418f1e8610
Instruction Fuzzy Hash: 9E01D2359002199BCB1AFBA4E806AAE7B71BFA4714F248509F4186B2D2CF309E048B91

Function 0018270D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182714
std::_Lockit::_Lockit.LIBCPMT ref: 0018271E

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018276F
std::_Lockit::~_Lockit.LIBCPMT ref: 0018278F

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5ecc7f86f5df66d5a0b1c8b7f5e485bce3f5933836a8a90f0867c343290c3448
Instruction ID: 2bf60807b9ddf31580d962cbb11eccc87a99ea109351bd20560a720b8536ee9e
Opcode Fuzzy Hash: 5ecc7f86f5df66d5a0b1c8b7f5e485bce3f5933836a8a90f0867c343290c3448
Instruction Fuzzy Hash: 9801D235900219DBCB06FB64D845AAE7771BFA4710F254509F824672D2CF70DF058F90

Function 0017D752 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017D759
std::_Lockit::_Lockit.LIBCPMT ref: 0017D763

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0017D7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 0017D7D4

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f0cd1696288a2164b85efe528f84420e4b6d131b0da09f0fd3e6ff650594bfb5
Instruction ID: 8dc04027d7dd941ef1d2abffb182e5e6a55095854d6318b11ae485791951a8cf
Opcode Fuzzy Hash: f0cd1696288a2164b85efe528f84420e4b6d131b0da09f0fd3e6ff650594bfb5
Instruction Fuzzy Hash: 1D01D2369002199FCB09FBA4E946AAE77B1AFA4714F248509F8196B2D1CF709E44CB91

Function 001827A2 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001827A9
std::_Lockit::_Lockit.LIBCPMT ref: 001827B3

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182804
std::_Lockit::~_Lockit.LIBCPMT ref: 00182824

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 34819fbf6a7146143f6e70bda3f7b0baabac8ed1877b87a18886f42cc807bd54
Instruction ID: fd1be86ae71cbd5b83b82e9effa57b801f7e872871d1121517f658554566a801
Opcode Fuzzy Hash: 34819fbf6a7146143f6e70bda3f7b0baabac8ed1877b87a18886f42cc807bd54
Instruction Fuzzy Hash: 8701DE359002199BCF06FBA4D805AAE77B1BFA8720F244509F9156B2D2CF309F05CF91

Function 0017D7E7 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0017D7EE
std::_Lockit::_Lockit.LIBCPMT ref: 0017D7F8

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0017D849
std::_Lockit::~_Lockit.LIBCPMT ref: 0017D869

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 04c026074ae41fcc667f10c482e1840a6c48c8c998f51bd208d57c7ae77a259d
Instruction ID: 2543d99a31470c22041ca4ab81cc26e60636ffd4bdebc6f6cd26a63886e9fcb9
Opcode Fuzzy Hash: 04c026074ae41fcc667f10c482e1840a6c48c8c998f51bd208d57c7ae77a259d
Instruction Fuzzy Hash: 6B01D631900219DFCB15FBA4E846ABEB7B1AFA4720F248449F4196B2D1CF30DE458B92

Function 00182837 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018283E
std::_Lockit::_Lockit.LIBCPMT ref: 00182848

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182899
std::_Lockit::~_Lockit.LIBCPMT ref: 001828B9

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 09ae228ef7a1fb2d6c0c9b82fc24e7f383b20ef7b5eaec63a1c5dabe2d708bbf
Instruction ID: 9565d86538cb4a0cea4768edc2d9ff08736e1bffb986c76b6a8c1a45a9500bbe
Opcode Fuzzy Hash: 09ae228ef7a1fb2d6c0c9b82fc24e7f383b20ef7b5eaec63a1c5dabe2d708bbf
Instruction Fuzzy Hash: 1F01A9359005299BCB06FBA4D905ABE77B1BFA4720F254519E414AB292CF709B048F91

Function 001828CC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001828D3
std::_Lockit::_Lockit.LIBCPMT ref: 001828DD

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018292E
std::_Lockit::~_Lockit.LIBCPMT ref: 0018294E

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e5899b029bd63da71fad9a43e8eb5b5393f4b7707c72e3eda6e9ef4590372899
Instruction ID: 9d560badb3d1d30bd7f70c46f3016215b962b4023e491f4377392b6de9b5f06e
Opcode Fuzzy Hash: e5899b029bd63da71fad9a43e8eb5b5393f4b7707c72e3eda6e9ef4590372899
Instruction Fuzzy Hash: 3F0100359002298BCB06FB649851ABE77B1AFA4720F244508F42467292CF709F058F90

Function 0018E96D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018E974
std::_Lockit::_Lockit.LIBCPMT ref: 0018E97E

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018E9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 0018E9EF

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 3e28ceb335f4f502dd9e22f8b1b767c045587241dcecf20bd6f58673396bffad
Instruction ID: 0228c949d494ca1407b54dcbc27fe9278c9e9e2b48d2a865e4e7d4dcdfab2166
Opcode Fuzzy Hash: 3e28ceb335f4f502dd9e22f8b1b767c045587241dcecf20bd6f58673396bffad
Instruction Fuzzy Hash: E701DE35900129ABCB16FB64D806ABE7BB1AFA4714F254509F5146B2E2CFB09F048F91

Function 0018EA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018EA09
std::_Lockit::_Lockit.LIBCPMT ref: 0018EA13

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018EA64
std::_Lockit::~_Lockit.LIBCPMT ref: 0018EA84

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: a5f017c3673d5b12d278cccbd7a4b243ed328cc9469bb1b0e0c341f64870cb18
Instruction ID: 1c2ee08493ea8b14c69250d36acf7768a687fc32c7aa37bb552911c708f2bcfa
Opcode Fuzzy Hash: a5f017c3673d5b12d278cccbd7a4b243ed328cc9469bb1b0e0c341f64870cb18
Instruction Fuzzy Hash: 7301D2359002199BCB19FB64D845AAEB7B1BFA4B10F254509F4146B2D2CF309F448F91

Function 00182BB5 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00182BC6

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00182C37

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 816fcecda1f769583c3765ed0f4c3d7f6d0ac69af40f8ce4c00a1947da190021
Instruction ID: 7e2a3f48b09b6f89ac4bfc2446eaa9c8f313bd9a4774c0afb2348bcb25170e16
Opcode Fuzzy Hash: 816fcecda1f769583c3765ed0f4c3d7f6d0ac69af40f8ce4c00a1947da190021
Instruction Fuzzy Hash: 5301DE35900219DBCB1AFBA4E805ABEB7B1AFA4710F24451AF8146B2D2DF309F04CF91

Function 0018EBC1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018EBC8
std::_Lockit::_Lockit.LIBCPMT ref: 0018EBD2

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018EC23
std::_Lockit::~_Lockit.LIBCPMT ref: 0018EC43

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 6884f74371bcf4ff598469bc1a3d1f2825245ddd00c546508428686bf9b3ae16
Instruction ID: 4d2ed1362b5950625a38f2caf4f5d2d43e19d469b2108a73d50e07916326097b
Opcode Fuzzy Hash: 6884f74371bcf4ff598469bc1a3d1f2825245ddd00c546508428686bf9b3ae16
Instruction Fuzzy Hash: CD01CC359001199BCB16FB649946ABE7BB1BFA4710F244949F418AB2D2CF30AF058F91

Function 0018EC56 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0018EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 0018EC67

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 0018ECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 0018ECD8

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1c98fdf19c17e28b0b5fe626647f4dbc3887ad6bb2f9a046a4868b016d92a452
Instruction ID: cb0cd8b0fc31da57e04b025e58fcd52d0517de3c243caf362437e008cdbe7f9d
Opcode Fuzzy Hash: 1c98fdf19c17e28b0b5fe626647f4dbc3887ad6bb2f9a046a4868b016d92a452
Instruction Fuzzy Hash: 7001CC35A00219DBCB06FB64D845AAEBBB1BFA4720F244419F4156B2D2CF309F458F91

Function 00182C4A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182C51
std::_Lockit::_Lockit.LIBCPMT ref: 00182C5B

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00182CCC

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: fbc696848d6666c1762336ad38c347b4bd522d94fd7da18b2793c972636a91d1
Instruction ID: fe063f075e0ef1acee79b0f5909a8f0b539df118d26ad4f424fe5b0ba1871749
Opcode Fuzzy Hash: fbc696848d6666c1762336ad38c347b4bd522d94fd7da18b2793c972636a91d1
Instruction Fuzzy Hash: E801DE39901219DBCB16FBA4D905ABE77B1AFA4710F254409F4156B2D2CF709F048F90

Function 00182CDF Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00182CF0

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00182D61

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c4e9310c6bed1d7cafab9cf16006e0432ddbe90a05164fa50b97098599075a5c
Instruction ID: ea41af41d2fbc07d66cec144c145f155e3ea92cc28ef7a6990bdc05d17cb3c13
Opcode Fuzzy Hash: c4e9310c6bed1d7cafab9cf16006e0432ddbe90a05164fa50b97098599075a5c
Instruction Fuzzy Hash: CE01C0359002199BCB16FBA49945AAE7B71BFA4710F244609F414772D2CF709F05CF91

Function 00182E09 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182E10
std::_Lockit::_Lockit.LIBCPMT ref: 00182E1A

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00182E8B

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 3fdb4acd700419141c69f31a0726798cb362bc0def0c6cb774f5cd0976ec1bc0
Instruction ID: dd021b745b8d47ec2ee29bcc8fa4aa54e7e7dcb5a801a65f74e599b0b4c2556e
Opcode Fuzzy Hash: 3fdb4acd700419141c69f31a0726798cb362bc0def0c6cb774f5cd0976ec1bc0
Instruction Fuzzy Hash: C601D236900119DBCB06FB64D805AAE77B1BFA4710F244909F814672D1CF709F448F90

Function 00182E9E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00182EAF

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00182F20

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 7fb42f07c87919e033afeebb66dfaf544c57df05a6bdb8ed02fd90c2f95edab8
Instruction ID: fdec731835a8ac45a33e9d40120ea86d1da658fcba0fffcf76114292faeade55
Opcode Fuzzy Hash: 7fb42f07c87919e033afeebb66dfaf544c57df05a6bdb8ed02fd90c2f95edab8
Instruction Fuzzy Hash: 1C01DE399002199BCB06FB64E805ABE77B1BFA4710F244519F5156B2D2DF709F04CF90

Function 00182F33 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00182F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00182F44

Part of subcall function 00178C20: std::_Lockit::_Lockit.LIBCPMT ref: 00178C50
Part of subcall function 00178C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00178C78

std::_Facet_Register.LIBCPMT ref: 00182F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00182FB5

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 18db79a660f50b514c3c0154fe694e324c9ce341b8418e687ca2f8b8e674bdde
Instruction ID: dffa780334376d0de7a7f89a22ae4390073b3b5b221237e0fa61254304235b1f
Opcode Fuzzy Hash: 18db79a660f50b514c3c0154fe694e324c9ce341b8418e687ca2f8b8e674bdde
Instruction Fuzzy Hash: 1A01CC35900219DBCB06FB649806ABEBBB1BFA4710F244509F914AB292CF309F44CF90

Function 001B3686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,001B3053,?,00000001,?,?,?,001B2198,?,?,00000000), ref: 001B369D
GetLastError.KERNEL32(?,001B3053,?,00000001,?,?,?,001B2198,?,?,00000000,?,?,?,001B271F,?), ref: 001B36A9

Part of subcall function 001B366F: CloseHandle.KERNEL32(FFFFFFFE,001B36B9,?,001B3053,?,00000001,?,?,?,001B2198,?,?,00000000,?,?), ref: 001B367F

___initconout.LIBCMT ref: 001B36B9

Part of subcall function 001B3631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001B3660,001B3040,?,?,001B2198,?,?,00000000,?), ref: 001B3644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,001B3053,?,00000001,?,?,?,001B2198,?,?,00000000,?), ref: 001B36CE

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 38db6d7dda72ae236d7ce93f079934d080f278764c33cc3d9943142810accc53
Instruction ID: 4eef18448ff5e98692230a454a3766ac27aaecb788430b7bb583953189c90808
Opcode Fuzzy Hash: 38db6d7dda72ae236d7ce93f079934d080f278764c33cc3d9943142810accc53
Instruction Fuzzy Hash: 17F01C36504118BBCF226F99DC08DCD3F66FB593A1B004150FE2996660D732CAB0EB90

Function 00192D20 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00192CBD,00000064), ref: 00192D43
LeaveCriticalSection.KERNEL32(001CDD3C,?,?,00192CBD,00000064,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00192CBD,00000064,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192D5E
EnterCriticalSection.KERNEL32(001CDD3C,?,00192CBD,00000064,?,?,?,001723B6,001CE638,E71D449C,?,?,001B3D6D,000000FF), ref: 00192D65

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 4e72c77f205afcffb725af3fda5d1ec57c004aaf361097f84d3d75d011b835e6
Instruction ID: 8b69688569c6fa17cefe2a5e1162cd6abeb285d22a884a8b30bd3bb4594ceac0
Opcode Fuzzy Hash: 4e72c77f205afcffb725af3fda5d1ec57c004aaf361097f84d3d75d011b835e6
Instruction Fuzzy Hash: EFE09232945524BBCB122FC4FC08EAA3F39AF45F11B000065F506665F1CB6089808BD1

Function 0017EC87 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0017EC8E

Part of subcall function 0017D87C: __EH_prolog3.LIBCMT ref: 0017D883
Part of subcall function 0017D87C: std::_Lockit::_Lockit.LIBCPMT ref: 0017D88D
Part of subcall function 0017D87C: std::_Lockit::~_Lockit.LIBCPMT ref: 0017D8FE

_Find_elem.LIBCPMT ref: 0017EE8A

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0017ECF6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 1388363724b6492f5546320b15d1212a86fa2b598a2f9e1a6a0d34697978b7ad
Instruction ID: 43ed6b295706b4c11bba94dcd423bb09bd8adca923df6222a094632b30386459
Opcode Fuzzy Hash: 1388363724b6492f5546320b15d1212a86fa2b598a2f9e1a6a0d34697978b7ad
Instruction Fuzzy Hash: CDC16234E042889EDF25DFA4C5507ECBBF2AF59304F2484E9E8996B287CB319D46CB51

Function 001862BE Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 001862C8

Part of subcall function 00182D74: __EH_prolog3.LIBCMT ref: 00182D7B
Part of subcall function 00182D74: std::_Lockit::_Lockit.LIBCPMT ref: 00182D85
Part of subcall function 00182D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00182DF6

_Find_elem.LIBCPMT ref: 00186502

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0018633F

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 9d3ee15bcfcdaa9c553d1db9cedb0a73651665432b5bc4b9ba4e938f1b032b0b
Instruction ID: 56bd2fab71edd92cb6b5e53f6654ff97caaeea8776febb80a62dc525d82bf5ed
Opcode Fuzzy Hash: 9d3ee15bcfcdaa9c553d1db9cedb0a73651665432b5bc4b9ba4e938f1b032b0b
Instruction Fuzzy Hash: AFC17370E042688BDF25FF64C8517BCBBB2BF55304F548099E889AB286DB349E85CF50

Function 00186694 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018669E

Part of subcall function 0017B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 0017B8DD
Part of subcall function 0017B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 0017B900
Part of subcall function 0017B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 0017B928
Part of subcall function 0017B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 0017B9B7

_Find_elem.LIBCPMT ref: 001868D8

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00186715

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 7d87ebc7cc6908a316117a540403b86e02bb6a20590f6ecae8234c7eccf825b7
Instruction ID: 7898cf818a2103f98d5f24420a31900d41f84a4b3337c61ab816a0bc83208690
Opcode Fuzzy Hash: 7d87ebc7cc6908a316117a540403b86e02bb6a20590f6ecae8234c7eccf825b7
Instruction Fuzzy Hash: 1CC16230E042688FDF25EF64C9957BCBBB2BF51304F548099D889AB286DB349E85DF50

Function 001A1A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001A1AFD

Strings

pow, xrefs: 001A1AD5, 001A1AF2

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 71e01d1699fdca1bd10c3e0db17386974d7746b59f09ddd91fa54a2cd3ad7e7a
Instruction ID: da0dbdbb40b14f374d406a537e603bf6392a8d3d74bfe57ab3fcfe20e4b6eae4
Opcode Fuzzy Hash: 71e01d1699fdca1bd10c3e0db17386974d7746b59f09ddd91fa54a2cd3ad7e7a
Instruction Fuzzy Hash: 4951796DA09201EACF157B14C9013BA7BB0FF53710FA08959F0C1822E9EB328CD5DA97

Function 00191E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00191FD1

Strings

-, xrefs: 00191FFF
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00191F2F, 00191F66, 00191F6B

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: ae45d943aef1460f52f9488630f5a7d7edad73ea7c8c48723d39b5f63e4a902c
Instruction ID: aa386dc516d85f6a2c931dc7c2bfc257dd9ba9b5ed12c5fc5925df9a3b476d18
Opcode Fuzzy Hash: ae45d943aef1460f52f9488630f5a7d7edad73ea7c8c48723d39b5f63e4a902c
Instruction Fuzzy Hash: 0E51F730B0424ABBDF298F7C84917BEBBF9AF06740F18445AE891D7241C3709D85C761

Function 0017BD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0017BF6E

Strings

true, xrefs: 0017BEAB
false, xrefs: 0017BE95

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 62235a21fa9a9a6d31e50a53ede017fbb897e6f84a8b955417f090dff9aa0a06
Instruction ID: 222e85c9c5118de906f334bc3d974a0f537f241d7e429092047c9987cdaef1cb
Opcode Fuzzy Hash: 62235a21fa9a9a6d31e50a53ede017fbb897e6f84a8b955417f090dff9aa0a06
Instruction Fuzzy Hash: 8D51D7B5D00748DFDB10DFA4C841BEEB7B8FF19304F14826AE845AB641E774AA85CB91

Function 001770A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00177173, 001771CE
\\?\, xrefs: 001771E3, 00177210

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: ac3d1b422d80a74a895ff590f74af5663d306a369f38eebf24001c30231de568
Instruction ID: 57f819bcca91c941f148a6f5c72c560cad38156d6444c8a69dd7d58368dbd416
Opcode Fuzzy Hash: ac3d1b422d80a74a895ff590f74af5663d306a369f38eebf24001c30231de568
Instruction Fuzzy Hash: 1651E171A14204ABDF14DF64C895FAEB7B5FFA4304F50851DE405B76C1DBB4A984CBA0

Function 0018D4FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018D501
_swprintf.LIBCMT ref: 0018D573

Part of subcall function 0018254E: __EH_prolog3.LIBCMT ref: 00182555
Part of subcall function 0018254E: std::_Lockit::_Lockit.LIBCPMT ref: 0018255F
Part of subcall function 0018254E: std::_Lockit::~_Lockit.LIBCPMT ref: 001825D0

Part of subcall function 00182FC8: __EH_prolog3.LIBCMT ref: 00182FCF

Strings

%.0Lf, xrefs: 0018D56B

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 3050236999-1402515088
Opcode ID: 949853a9221fff1d15e19c82d47046ce38ce77f201944a440c1873eab7c8fcbc
Instruction ID: 38e155f8ae88c45334568408814e453e15fec3d71f5cd90ff9d6364bbb8859e5
Opcode Fuzzy Hash: 949853a9221fff1d15e19c82d47046ce38ce77f201944a440c1873eab7c8fcbc
Instruction Fuzzy Hash: A0416A71E00309ABCF09EFE0D845AED7BB5FF58304F208549E846AB295EB359A15CF90

Function 0018D79E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018D7A5
_swprintf.LIBCMT ref: 0018D817

Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178657
Part of subcall function 00178610: std::_Lockit::_Lockit.LIBCPMT ref: 00178679
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 001786A1
Part of subcall function 00178610: std::_Lockit::~_Lockit.LIBCPMT ref: 0017880E

Strings

%.0Lf, xrefs: 0018D80F

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 7b915dbb3a436375dce5f019983593f33a8d2a8d525d324b6e4597d55b88cc9b
Instruction ID: 0614ca78944e15edacb2dd7506f2905b9dc96bef6d3181ef535bf1424f659939
Opcode Fuzzy Hash: 7b915dbb3a436375dce5f019983593f33a8d2a8d525d324b6e4597d55b88cc9b
Instruction Fuzzy Hash: 2E417B71E00319ABCF09EFE4D845AED7BB5FF18300F208559E846AB295EB359A15CF90

Function 00191887 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0019188E
_swprintf.LIBCMT ref: 00191900

Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792A0
Part of subcall function 00179270: std::_Lockit::_Lockit.LIBCPMT ref: 001792C2
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 001792EA
Part of subcall function 00179270: std::_Lockit::~_Lockit.LIBCPMT ref: 00179422

Strings

%.0Lf, xrefs: 001918F8

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: f7c847e778c03580ea6a807e462aa9b121a48889883036ea5992c40d0ca279b9
Instruction ID: 12ade17d806a4390a131a53d07cdfb4cc0f4825e40a6399119067a95b8d1848c
Opcode Fuzzy Hash: f7c847e778c03580ea6a807e462aa9b121a48889883036ea5992c40d0ca279b9
Instruction Fuzzy Hash: D3418971E00209ABCF09EFE0C854AED7BB5FF18304F208549E846AB291DB35AA55DF90

Function 00196059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0019607E

Strings

MOC, xrefs: 00196090
RCC, xrefs: 00196098

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b5691b24cdf7b77074ad507b9b787dfb538d7d2ec4a8657252c6d85471a1c83d
Instruction ID: f68b2d156720bd406880deb4e7c9c64f18cb42bbc1b4c49d1b0cc9dffae696a5
Opcode Fuzzy Hash: b5691b24cdf7b77074ad507b9b787dfb538d7d2ec4a8657252c6d85471a1c83d
Instruction Fuzzy Hash: 87416A71900209EFCF16DF98CD81AEEBBB6FF88304F188169F908A7252D3359951DB61

Function 0018DF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0018DF96
__cftoe.LIBCMT ref: 0018E01A

Strings

!%x, xrefs: 0018DFA7

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e5afae42f9ab0df2fa9dab25d2971aa6a61e66e9bd973e38fb9d4b4f05ef6019
Instruction ID: 490b67be5197d4647b2fbac0a4cff31ad10b947ee8492d797e6abd10bbddfb76
Opcode Fuzzy Hash: e5afae42f9ab0df2fa9dab25d2971aa6a61e66e9bd973e38fb9d4b4f05ef6019
Instruction Fuzzy Hash: 74314671E00209EBDF04EF94E981AEEB7B6FF18304F204819F905A7251DB75AA46CF64

Function 001919FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00191A01
__cftoe.LIBCMT ref: 00191A7F

Strings

!%x, xrefs: 00191A15

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: df583f4a8fae6e0864d50de2a90eb2679e57bf81553dc0ed7abdb59b6fb4c7b3
Instruction ID: 1137d1bc62271d53560c9a7df00dc02df1d58e7870643a7c143088e221643604
Opcode Fuzzy Hash: df583f4a8fae6e0864d50de2a90eb2679e57bf81553dc0ed7abdb59b6fb4c7b3
Instruction Fuzzy Hash: 8A318D72D1528DAFEF04DF98D881AEEBBB5FF19300F144019F845A7242D7759A85CBA0

Function 00175F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00175F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,E71D449C), ref: 00175FF6

Strings

Invalid SID, xrefs: 00175FD4

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: da78e3fd65eac2b5ba6d4844d238eaa72510cc5a1b7ac756c3f3f3de974f3748
Instruction ID: 3fadbe374b19ea8d8073a2eec4eb3a329b7d430bad10fc34f28e50b3da59409a
Opcode Fuzzy Hash: da78e3fd65eac2b5ba6d4844d238eaa72510cc5a1b7ac756c3f3f3de974f3748
Instruction Fuzzy Hash: A821C074A04605DBDB14DF58C815BAFBBF9FF44714F104A1EE405A7780D7B6AA448BD0

Function 00179070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0017909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001790FE

Strings

bad locale name, xrefs: 00179121

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: fc9bfb73a774e500bece6a692582fbb080842d65a47be411f91e31cf18184264
Instruction ID: 3b79ae7b949863cdc3169f5dcee94b02001406603693d5ebfe8e8b6017bc8082
Opcode Fuzzy Hash: fc9bfb73a774e500bece6a692582fbb080842d65a47be411f91e31cf18184264
Instruction Fuzzy Hash: F221C370905784DED721CFA8C904B4BBFF4EF29710F10869DE49997781D3B5A608CBA1

Function 0017F098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0017F09F

Strings

true, xrefs: 0017F109
false, xrefs: 0017F0F6

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 7b0863c6191153510a85553f682c13599e2f02a751b4f299ebb97ba5fafcb38d
Instruction ID: 8444e921fda7f2617011befc0b7307feacafbc97fa347803a612ef8e50db7527
Opcode Fuzzy Hash: 7b0863c6191153510a85553f682c13599e2f02a751b4f299ebb97ba5fafcb38d
Instruction Fuzzy Hash: E5119075941B44AEC724EFB4D841B8AB7F4AF29300F14C52EF4A69B641EB30E605CB90

Function 0017D0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0017C630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,E71D449C,?,001B3D30,000000FF), ref: 0017C657
Part of subcall function 0017C630: GetLastError.KERNEL32(?,00000000,00000000,E71D449C,?,001B3D30,000000FF), ref: 0017C661

IsDebuggerPresent.KERNEL32(?,?,001C8AF0), ref: 0017D0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,001C8AF0), ref: 0017D0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0017D0E2

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: a6043e52719147c4e478cd3ad441ed423bff3cce3e2a10035e38cfe4194e7b30
Instruction ID: ea08b46addb80744a651f18ca63a1d07ce7b10386e13f96af0cdfe2bf2ecaacb
Opcode Fuzzy Hash: a6043e52719147c4e478cd3ad441ed423bff3cce3e2a10035e38cfe4194e7b30
Instruction Fuzzy Hash: A4E092B02047518FD320AF38E5047827BF0AF55340F04C99DF449E2780D7B0D4888BA1

Function 00174070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,00174261,001B4400,000000FF,E71D449C,00000000,?,00000000,?,?,?,001B4400,000000FF,?,00173A75,?), ref: 00174096
LocalAlloc.KERNEL32(00000040,40000022,E71D449C,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00174154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,E71D449C,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00174177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00174217

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 78506eb906f7e2539b15ec13b67a52cb70f9992fd9252fbcf5a24f89a0848b87
Instruction ID: ac8dcdceb34aa07e629c347e146d9de6e9e714477ee67489aadf63aefe5e3583
Opcode Fuzzy Hash: 78506eb906f7e2539b15ec13b67a52cb70f9992fd9252fbcf5a24f89a0848b87
Instruction Fuzzy Hash: 4651AEB5A002059FDB18DF6CD885AAEBBB5FB48350F14862DF929E7381D730AD50CB90

Function 00171D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 00171E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 00171E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 00171EA7
LocalFree.KERNEL32(00000001,E71D449C,00000000,00000000,001B3C40,000000FF,?,00000000), ref: 00171F2D

Memory Dump Source

Source File: 00000005.00000002.1770339996.0000000000171000.00000020.00000001.01000000.00000004.sdmp, Offset: 00170000, based on PE: true

Associated: 00000005.00000002.1770298597.0000000000170000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770418622.00000000001B7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770476643.00000000001CC000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1770522235.00000000001D0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_170000_MSI706F.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 4fea0bee2b48c9e5c23efdc786ecc291a7e97dc09a72ddac74eebc3a43955c59
Instruction ID: ce5102205e6dec9cb3028dc9fa3cdff60a98ba32addde1c70ccdc58a02d9048a
Opcode Fuzzy Hash: 4fea0bee2b48c9e5c23efdc786ecc291a7e97dc09a72ddac74eebc3a43955c59
Instruction Fuzzy Hash: B251D272508215AFC725DF2CDC40A6AB7F9FB89350F114A2EF86AD7690DB30E9448B91

Analysis Process: thelper.exePID: 7224, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	391
Total number of Limit Nodes:	24

Executed Functions

Function 00F81A70 Relevance: 93.0, APIs: 43, Strings: 10, Instructions: 300
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(00FA2AA4,7E2FC452,00FAC508,011605A0,?,00000000,00F9E048,000000FF,00F820BA), ref: 00F81AB7

Part of subcall function 00F86CF0: ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90 ref: 00F86D5D
Part of subcall function 00F86CF0: ??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z.MSVCP90(00FAC5B8,00FA2AA4,7E2FC452,00FAC508,011605A0,?,00000000), ref: 00F86D81
Part of subcall function 00F86CF0: memset.MSVCR90 ref: 00F86DA4
Part of subcall function 00F86CF0: PathFileExistsW.SHLWAPI ref: 00F86DDC
Part of subcall function 00F86CF0: PathFileExistsW.SHLWAPI(?), ref: 00F86DF3
Part of subcall function 00F86CF0: PathIsDirectoryW.SHLWAPI(?), ref: 00F86DFE
Part of subcall function 00F86CF0: SHGetValueW.SHLWAPI(80000001,SOFTWARE\Thunder Network\Thunder,Path,?,?,80000002), ref: 00F86E22
Part of subcall function 00F86CF0: PathFileExistsW.SHLWAPI(?), ref: 00F86E2D
Part of subcall function 00F86CF0: PathIsDirectoryW.SHLWAPI(?), ref: 00F86E38
Part of subcall function 00F86CF0: PathCombineW.SHLWAPI(?,?,..\..\), ref: 00F86E4B

memset.MSVCR90 ref: 00F81AEA
PathCombineW.SHLWAPI(?,?,Program\), ref: 00F81B15
memset.MSVCR90 ref: 00F81B2F
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00F81B46
PathRemoveFileSpecW.SHLWAPI(?), ref: 00F81B54
memset.MSVCR90 ref: 00F81B72
PathCombineW.SHLWAPI(?,?,XLBugReport.exe), ref: 00F81B8F
PathFileExistsW.SHLWAPI(?), ref: 00F81B9F
PathIsDirectoryW.SHLWAPI(?), ref: 00F81BB3
memset.MSVCR90 ref: 00F81BCF
PathCombineW.SHLWAPI(?,?,XLBugReport.exe), ref: 00F81BE9
CopyFileW.KERNEL32(?,?,00000000), ref: 00F81BFA
memset.MSVCR90 ref: 00F81C14
PathCombineW.SHLWAPI(?,?,XLBugHandler.dll), ref: 00F81C31
PathFileExistsW.SHLWAPI(?), ref: 00F81C3B
PathIsDirectoryW.SHLWAPI(?), ref: 00F81C49
memset.MSVCR90 ref: 00F81C65
PathCombineW.SHLWAPI(?,?,XLBugHandler.dll), ref: 00F81C7F
CopyFileW.KERNEL32(?,?,00000000), ref: 00F81C90
memset.MSVCR90 ref: 00F81CAA
PathCombineW.SHLWAPI(?,?,minizip.dll), ref: 00F81CC7
PathFileExistsW.SHLWAPI(?), ref: 00F81CD1
PathIsDirectoryW.SHLWAPI(?), ref: 00F81CDF
memset.MSVCR90 ref: 00F81CFB
PathCombineW.SHLWAPI(?,?,minizip.dll), ref: 00F81D15
CopyFileW.KERNEL32(?,?,00000000), ref: 00F81D26
PathFileExistsW.SHLWAPI(?), ref: 00F81D30
PathIsDirectoryW.SHLWAPI(?), ref: 00F81D42
LoadLibraryW.KERNEL32(?), ref: 00F81D58
memset.MSVCR90 ref: 00F81D7C
GetTempPathW.KERNEL32(00000104,?), ref: 00F81D91
PathAppendW.SHLWAPI(?,BrowserSupportDump\), ref: 00F81DA4
GetProcAddress.KERNEL32(00000000,_XL_SetBugReportRootDir@4), ref: 00F81DB6
GetProcAddress.KERNEL32(00000000,_XL_InitBugHandler@20), ref: 00F81DC8
FreeLibrary.KERNEL32(00000000), ref: 00F81DD1
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F81DE6
GetProcAddress.KERNEL32(00000000,_XL_SetAlwaysSendReport@4), ref: 00F81DFC
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F81E08
memset.MSVCR90 ref: 00F81E25
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000,00000208), ref: 00F81E3C
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F81E8E
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F81EA3

Strings

_XL_SetAlwaysSendReport@4, xrefs: 00F81DF6
XLBugHandler.dll, xrefs: 00F81C1C, 00F81C6D
_XL_SetBugReportRootDir@4, xrefs: 00F81DB0
BrowserSupportDump\, xrefs: 00F81D97
Program\, xrefs: 00F81B07
minizip.dll, xrefs: 00F81CB2, 00F81D03
_XL_InitBugHandler@20, xrefs: 00F81DC2
XLBugReport.exe, xrefs: 00F81B7A, 00F81BD7
-bug, xrefs: 00F81E71
BrowserSupport, xrefs: 00F81E6C

Memory Dump Source

Source File: 00000007.00000002.1785982664.0000000000F81000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000007.00000002.1785946057.0000000000F80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786079153.0000000000FAB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786123133.0000000000FAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f80000_thelper.jbxd

Similarity

API ID: Path$File$memset$CombineU?$char_traits@_V?$allocator@_W@std@@$Exists$DirectoryW@2@@std@@$??0?$basic_string@_??1?$basic_string@_AddressCopyProc$LibraryModuleName$??$?8_AppendFreeLoadRemoveSpecTempV?$basic_string@_ValueW@1@@std@@W@2@@0@
String ID: -bug$BrowserSupport$BrowserSupportDump\$Program\$XLBugHandler.dll$XLBugReport.exe$_XL_InitBugHandler@20$_XL_SetAlwaysSendReport@4$_XL_SetBugReportRootDir@4$minizip.dll
API String ID: 1687364463-214281796
Opcode ID: e573b904a391581d49c5035ef8aaaef8e7dd6953d5e6ac294a57816a573542cb
Instruction ID: cd0f48c3a03fe56b3305b69560c226d4e80478ecf69d1b2565bc829f594b1ad4
Opcode Fuzzy Hash: e573b904a391581d49c5035ef8aaaef8e7dd6953d5e6ac294a57816a573542cb
Instruction Fuzzy Hash: DDB11FB2508384ABD334EBA4DC45FEBB7E8AFC8700F04491DF599C2191EAB5D5099B63

Function 00F81F20 Relevance: 72.0, APIs: 34, Strings: 7, Instructions: 236
synchronizationwindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(xl8.browserSupport.mutexId,7E2FC452), ref: 00F81F66
CreateMutexW.KERNEL32(00000000,00000001,?), ref: 00F81F91
GetLastError.KERNEL32 ref: 00F81FA1
CloseHandle.KERNEL32(00000000), ref: 00F81FB3
FindWindowW.USER32(00000000,browserSupport.cmdlistener.wnd), ref: 00F81FBF
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(BringWndToTop), ref: 00F81FD4
??2@YAPAXI@Z.MSVCR90 ref: 00F81FE4
SendMessageW.USER32(00000000,0000004A,00000000,00000000), ref: 00F82019
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F8202A
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F82042
EnterCriticalSection.KERNEL32(00FAC508), ref: 00F82089
GetCurrentThreadId.KERNEL32 ref: 00F8208F

Part of subcall function 00F82510: _recalloc.MSVCR90(?,00000002,00000004,00FAC508,00F820AE,?,?), ref: 00F82521

LeaveCriticalSection.KERNEL32(00FAC508,?,?), ref: 00F820AF

Part of subcall function 00F81A70: ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(00FA2AA4,7E2FC452,00FAC508,011605A0,?,00000000,00F9E048,000000FF,00F820BA), ref: 00F81AB7
Part of subcall function 00F81A70: memset.MSVCR90 ref: 00F81AEA
Part of subcall function 00F81A70: PathCombineW.SHLWAPI(?,?,Program\), ref: 00F81B15
Part of subcall function 00F81A70: memset.MSVCR90 ref: 00F81B2F
Part of subcall function 00F81A70: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00F81B46
Part of subcall function 00F81A70: PathRemoveFileSpecW.SHLWAPI(?), ref: 00F81B54
Part of subcall function 00F81A70: memset.MSVCR90 ref: 00F81B72
Part of subcall function 00F81A70: PathCombineW.SHLWAPI(?,?,XLBugReport.exe), ref: 00F81B8F
Part of subcall function 00F81A70: PathFileExistsW.SHLWAPI(?), ref: 00F81B9F
Part of subcall function 00F81A70: PathIsDirectoryW.SHLWAPI(?), ref: 00F81BB3
Part of subcall function 00F81A70: memset.MSVCR90 ref: 00F81BCF
Part of subcall function 00F81A70: PathCombineW.SHLWAPI(?,?,XLBugReport.exe), ref: 00F81BE9

XL_PrepareGraphicParam.XLGRAPHIC(?), ref: 00F820BF
XL_InitGraphicLib.XLGRAPHIC(?), ref: 00F820CE
XL_SetFreeTypeEnabled.XLGRAPHIC(00000001), ref: 00F820D6
WSAStartup.WS2_32(00000202,?), ref: 00F820E9
exit.MSVCR90 ref: 00F820F4
XLFS_Init.XLFSIO ref: 00F820FA
XLUE_InitLoader.XLUE(00000000), ref: 00F82101
XLLRT_GetEnv.XLLUARUNTIME(00000000), ref: 00F82108
memset.MSVCR90 ref: 00F82151
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00F82167
PathRemoveFileSpecW.SHLWAPI(?), ref: 00F82175
PathAddBackslashW.SHLWAPI(?), ref: 00F82183
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(?), ref: 00F82195
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z.MSVCP90 ref: 00F821B1
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F821C6
XLUE_AddXARSearchPath.XLUE(?), ref: 00F821E5
XLUE_LoadXAR.XLUE(BrowserSupport), ref: 00F821F0
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F82255
free.MSVCR90(?), ref: 00F8226A
free.MSVCR90(?), ref: 00F82284
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F822A7

Strings

v, xrefs: 00F820AF
-repair, xrefs: 00F821FD
BringWndToTop, xrefs: 00F81FCB
Xar\, xrefs: 00F8219B
browserSupport.cmdlistener.wnd, xrefs: 00F81FB9
BrowserSupport, xrefs: 00F821EB
xl8.browserSupport.mutexId, xrefs: 00F81F5A

Memory Dump Source

Source File: 00000007.00000002.1785982664.0000000000F81000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000007.00000002.1785946057.0000000000F80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786079153.0000000000FAB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786123133.0000000000FAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f80000_thelper.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@std@@$PathW@2@@std@@$??1?$basic_string@_Filememset$??0?$basic_string@_$CombineInit$CriticalGraphicModuleNameRemoveSectionSpecfree$??$???2@BackslashCloseCreateCurrentDirectoryEnabledEnterErrorExistsFindFreeHandleLastLeaveLoadLoaderMessageMutexParamPrepareSearchSendStartupThreadTypeV10@V?$basic_string@_W@1@@std@@W@2@@0@Window_recallocexit
String ID: v$-repair$BringWndToTop$BrowserSupport$Xar\$browserSupport.cmdlistener.wnd$xl8.browserSupport.mutexId
API String ID: 3363966529-2146482043
Opcode ID: 36c22b5296f6c05fb2f7a76c26e2b10a70b17c85e8cca92edb65f344fcf5ddd7
Instruction ID: 00483c1fdf87bad5c3b7de6c0e83ab3a21ba3ac29b6099ed4186049926cae17f
Opcode Fuzzy Hash: 36c22b5296f6c05fb2f7a76c26e2b10a70b17c85e8cca92edb65f344fcf5ddd7
Instruction Fuzzy Hash: 30A19DB15083449FD720EF74DC88AAAB7E8FF99315F444A2EF58AC2262D7349508DB53

Function 00F86CF0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90 ref: 00F86D5D

Part of subcall function 00F8E39E: __onexit.MSVCRT ref: 00F8E3A6

??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z.MSVCP90(00FAC5B8,00FA2AA4,7E2FC452,00FAC508,011605A0,?,00000000), ref: 00F86D81
memset.MSVCR90 ref: 00F86DA4
PathFileExistsW.SHLWAPI ref: 00F86DDC
PathFileExistsW.SHLWAPI(?), ref: 00F86DF3
PathIsDirectoryW.SHLWAPI(?), ref: 00F86DFE
SHGetValueW.SHLWAPI(80000001,SOFTWARE\Thunder Network\Thunder,Path,?,?,80000002), ref: 00F86E22
PathFileExistsW.SHLWAPI(?), ref: 00F86E2D
PathIsDirectoryW.SHLWAPI(?), ref: 00F86E38
PathCombineW.SHLWAPI(?,?,..\..\), ref: 00F86E4B
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z.MSVCP90(?), ref: 00F86E5B
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z.MSVCP90(-00000001), ref: 00F86E6E
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z.MSVCP90(00FA2D74), ref: 00F86E84
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z.MSVCP90(00FAC5B8), ref: 00F86E91

Strings

Path, xrefs: 00F86E13
..\..\, xrefs: 00F86E3E
SOFTWARE\Thunder Network\Thunder, xrefs: 00F86E18
SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd, xrefs: 00F86DC0
instdir, xrefs: 00F86DBB

Memory Dump Source

Source File: 00000007.00000002.1785982664.0000000000F81000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000007.00000002.1785946057.0000000000F80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786079153.0000000000FAB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786123133.0000000000FAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f80000_thelper.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@std@@$Path$W@2@@std@@$ExistsFileV01@$??4?$basic_string@_Directory$??$?8_??0?$basic_string@_A?$basic_string@_CombineV01@@V?$basic_string@_ValueW@1@@std@@W@2@@0@Y?$basic_string@___onexitmemset
String ID: ..\..\$Path$SOFTWARE\Thunder Network\Thunder$SOFTWARE\Thunder Network\ThunderOem\thunder_backwnd$instdir
API String ID: 2108441883-774939401
Opcode ID: e1b7da4d1c8a841b3f55fde8780128bfa4b08078966ac480f78d69beea761156
Instruction ID: 290b39b429bc3fc7f07f8aad6c8f09756a79b269000b11c19548969a739faaa4
Opcode Fuzzy Hash: e1b7da4d1c8a841b3f55fde8780128bfa4b08078966ac480f78d69beea761156
Instruction Fuzzy Hash: 0941B5B1604305AFC714EB58DC45FAB77E8EB89714F04452EF955C3190EB74E508EBA2

Function 00F82320 Relevance: 10.6, APIs: 7, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00F8232D
DefWindowProcW.USER32(00000000,00000000,00000000,00000000), ref: 00F8233B
InitCommonControlsEx.COMCTL32 ref: 00F82356

Part of subcall function 00F81600: GetCurrentThreadId.KERNEL32 ref: 00F8163B
Part of subcall function 00F81600: ??2@YAPAXI@Z.MSVCR90 ref: 00F81651

Part of subcall function 00F81F20: ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(xl8.browserSupport.mutexId,7E2FC452), ref: 00F81F66
Part of subcall function 00F81F20: CreateMutexW.KERNEL32(00000000,00000001,?), ref: 00F81F91
Part of subcall function 00F81F20: GetLastError.KERNEL32 ref: 00F81FA1
Part of subcall function 00F81F20: CloseHandle.KERNEL32(00000000), ref: 00F81FB3
Part of subcall function 00F81F20: FindWindowW.USER32(00000000,browserSupport.cmdlistener.wnd), ref: 00F81FBF
Part of subcall function 00F81F20: ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP90(BringWndToTop), ref: 00F81FD4
Part of subcall function 00F81F20: ??2@YAPAXI@Z.MSVCR90 ref: 00F81FE4
Part of subcall function 00F81F20: SendMessageW.USER32(00000000,0000004A,00000000,00000000), ref: 00F82019
Part of subcall function 00F81F20: ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F8202A
Part of subcall function 00F81F20: ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00F82042

Part of subcall function 00F81760: EnterCriticalSection.KERNEL32(00FAC508,?,?,00F82376), ref: 00F8176C
Part of subcall function 00F81760: DestroyWindow.USER32(?,?,?,00F82376), ref: 00F81786
Part of subcall function 00F81760: free.MSVCR90(?,?,?,00F82376), ref: 00F8179E
Part of subcall function 00F81760: ??3@YAXPAX@Z.MSVCR90 ref: 00F817BC
Part of subcall function 00F81760: LeaveCriticalSection.KERNEL32(00FAC508,?,?,00F82376), ref: 00F817CF

free.MSVCR90(00000000), ref: 00F8238D
free.MSVCR90(01166618), ref: 00F823A0
??3@YAXPAX@Z.MSVCR90 ref: 00F823B4
CoUninitialize.OLE32 ref: 00F823C1

Memory Dump Source

Source File: 00000007.00000002.1785982664.0000000000F81000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000007.00000002.1785946057.0000000000F80000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786041431.0000000000F9F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786079153.0000000000FAB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1786123133.0000000000FAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f80000_thelper.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$Windowfree$??0?$basic_string@_??1?$basic_string@_??2@??3@CriticalSection$CloseCommonControlsCreateCurrentDestroyEnterErrorFindHandleInitInitializeLastLeaveMessageMutexProcSendThreadUninitialize
String ID:
API String ID: 3978411270-0
Opcode ID: 3aec9045f6e96dfac0c7524d4461652483bbe91b3be8449d6a5599a786d80714
Instruction ID: 89f731ce45a494ca24538e9ed6cde5fe9106f0ba9919f95089cf8d5d89b6d820
Opcode Fuzzy Hash: 3aec9045f6e96dfac0c7524d4461652483bbe91b3be8449d6a5599a786d80714
Instruction Fuzzy Hash: 5F1182B1A003056BD720BF65DC0AB8B7BA8BF44711F144929F999D7290DB74F418DBA2

Function 00E7EC90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00E7ECB6
PathAppendW.SHLWAPI(?,..\FontSetting.ini), ref: 00E7ECD7
PathFileExistsW.KERNELBASE ref: 00E7ECE1

Part of subcall function 00E7F450: _DebugHeapAllocator.LIBCPMTD ref: 00E7F4AA
Part of subcall function 00E7F450: _itow.MSVCR90 ref: 00E7F4DA
Part of subcall function 00E7F450: _itow.MSVCR90 ref: 00E7F528

Strings

..\FontSetting.ini, xrefs: 00E7ECCD

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Path_itow$AllocatorAppendDebugExistsFileHeapmemset
String ID: ..\FontSetting.ini
API String ID: 1855005611-1583566485
Opcode ID: 4ccfb890b9e4f130b2a73f1f01ac996fb977e639f4a5d8f56a3e624e676cc928
Instruction ID: 00fdbb5d23520fbafb78bd3ea04f27fb6a1124761981082cb7cb499f7abd9504
Opcode Fuzzy Hash: 4ccfb890b9e4f130b2a73f1f01ac996fb977e639f4a5d8f56a3e624e676cc928
Instruction Fuzzy Hash: E80121B46183016BC624FBB4D85AB6F73D4DF88704F40E92DF1AAA7192EA74D1049792

Function 00ECF350 Relevance: 4.5, APIs: 3, Instructions: 48
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00000000,00000000), ref: 00ECF389
HeapSetInformation.KERNEL32(00000000,00000000,00000002,00000004), ref: 00ECF3B3
GetProcessHeap.KERNEL32 ref: 00ECF3BB

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Heap$CreateInformationProcess
String ID:
API String ID: 3982942217-0
Opcode ID: 8a8593eb4376b4efac36e5994f8e4a1870a03be01600206f1e5b312193874d38
Instruction ID: 38a4435e31dbd9983741bc0f02363988d38ea679897d85bc7ff3825490090592
Opcode Fuzzy Hash: 8a8593eb4376b4efac36e5994f8e4a1870a03be01600206f1e5b312193874d38
Instruction Fuzzy Hash: 17119A74E05288FBDB00CFA5C554BADBBB2EF45304F14C0AEE8106B381C3769A06DB90

Function 00FED9D0 Relevance: 4.5, APIs: 3, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00FEDA09
HeapSetInformation.KERNEL32(00000000,00000000,00000002,00000004), ref: 00FEDA33
GetProcessHeap.KERNEL32 ref: 00FEDA3B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: Heap$CreateInformationProcess
String ID:
API String ID: 3982942217-0
Opcode ID: f967aabb5a345b4216f3e96cef864063d2100320fad89abd41e01127bd2aa83b
Instruction ID: 79e32c1c0c5a93ce9e2f32f28878eaa1707880f1136d480a02923ec469edaa5e
Opcode Fuzzy Hash: f967aabb5a345b4216f3e96cef864063d2100320fad89abd41e01127bd2aa83b
Instruction Fuzzy Hash: 03117C78E08288EFDB04CFA1C454BADBBB6BF46704F14C099E8155B382C77A9A05EB50

Function 00E7C2B0 Relevance: 4.5, APIs: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00E7C2D8
SystemParametersInfoW.USER32 ref: 00E7C2F3
wcsncpy.MSVCR90 ref: 00E7C31E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: InfoParametersSystemmemsetwcsncpy
String ID:
API String ID: 1250501251-0
Opcode ID: 889eb22943f55a66dd75703dc04cf60de33558c8276663bb1a8f9a0be4b33ebf
Instruction ID: 912e22100843ad03702b1369ac449e85942d42fc2a02c30957029a8022314df0
Opcode Fuzzy Hash: 889eb22943f55a66dd75703dc04cf60de33558c8276663bb1a8f9a0be4b33ebf
Instruction Fuzzy Hash: E101A2B05503016FE324AB60DC4ABBF33D8EBC4704F40481DB1156B291DA7465088793

Function 00FC3C70 Relevance: 3.1, APIs: 2, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Xlen@_String_base@std@@SAXXZ.MSVCP90(?,00000000,?,00FC6CA0,?,?,E3DC3B0A,?,00000000,?,?,00000000,?,00FEF09B,000000FF,00FC6D63), ref: 00FC3CCC
memcpy_s.MSVCR90 ref: 00FC3D27

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: String_base@std@@Xlen@_memcpy_s
String ID:
API String ID: 4060184576-0
Opcode ID: 7be9642de8cc62f1b9aafd157ce6a81c6a81876750dbfa59d66df050edfc03e7
Instruction ID: 80fd4c7b651744a10a63e7565de994bfe658175f3ad39341e99cfb8b16b3c474
Opcode Fuzzy Hash: 7be9642de8cc62f1b9aafd157ce6a81c6a81876750dbfa59d66df050edfc03e7
Instruction Fuzzy Hash: ED21F532300A068BD724DE4CE685F6FF3EAEBD1790B10881EE0539B691D731AE4597A1

Function 00FC3420 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy_s.MSVCR90 ref: 00FC34E0

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 84ad4aa1ef3dff56e7f1b02e3d146696960546dfbc829f29338f7cf3b5d987bf
Instruction ID: 82af5245811b0b8c3648f28f7985bf29b5e4621702a6417581ba8c84ed4de6be
Opcode Fuzzy Hash: 84ad4aa1ef3dff56e7f1b02e3d146696960546dfbc829f29338f7cf3b5d987bf
Instruction Fuzzy Hash: 6831B4B1904606EFD718CF19D981B59B7F9FB08350F00862EE826C7781D771AA44DBD1

Function 00ECF3E0 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapDestroy.KERNELBASE(?), ref: 00ECF3F8

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 8e9cd66c6c75f9181fbb9490434fd5eb266c3108601c84c83f022c579400d3f2
Instruction ID: 8a6bc156887ff9d36fe33669922764cd501a854e14371ea751acebd3ddeabfc9
Opcode Fuzzy Hash: 8e9cd66c6c75f9181fbb9490434fd5eb266c3108601c84c83f022c579400d3f2
Instruction Fuzzy Hash: BBE0ED74905148EFCB04DFA9E55495DBBB4EB09301B2481D9E80997311C6319E019B91

Function 00FEDA60 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapDestroy.KERNELBASE(?), ref: 00FEDA78

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: aa417da19c64d775f2a6a764b0c35cf64504f2647bf7e94c459429d79838b5fa
Instruction ID: 23e87a68e6106bb254ce72fe9781c8f480f7ad41c67af75000b0c57e2dc148f5
Opcode Fuzzy Hash: aa417da19c64d775f2a6a764b0c35cf64504f2647bf7e94c459429d79838b5fa
Instruction Fuzzy Hash: FAE01A78906148EFCB04CF99DA5496DFBF8AF09301F2482D9E80997311C631AF41EBA0

Function 00FEDAA0 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00FEDAD0

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6dae75e4ed3e8bcc71cd298b6ccf15faadcda2624a9f5d5dc836363da67fefa4
Instruction ID: 48dffaa6fc9b42e63b207957c03f140ab9d4e8bbeddff6aa3e237b24d718f988
Opcode Fuzzy Hash: 6dae75e4ed3e8bcc71cd298b6ccf15faadcda2624a9f5d5dc836363da67fefa4
Instruction Fuzzy Hash: 68E01A75905148ABCB04EFA5D914AAEBBB8AF45300F108199E844A7240DB359A04EBA0

Function 00ECF420 Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(00000000,00000000,00000000), ref: 00ECF450

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ba90e2625d6e48a30409a1b713c2a42f018dac79cd94ca0b606e0dd3f8c72cc0
Instruction ID: f426b0fede76a325a054373e8641a707dedbd4ec0df65de41cdc92d49d64dd4a
Opcode Fuzzy Hash: ba90e2625d6e48a30409a1b713c2a42f018dac79cd94ca0b606e0dd3f8c72cc0
Instruction Fuzzy Hash: D0E04F70904208ABCB04EFA5E904B9EBFB9AF44300F50819DE944A7340DA319B0ADBA0

Non-executed Functions

Function 00E78AF0 Relevance: 10.7, APIs: 7, Instructions: 217windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90(00000000,?,?,00000000), ref: 00E78B0E
XL_ClipSubBindBitmap.MSVCR90(?,?,?,00000000,?,?,00000000), ref: 00E78B40

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipInfo
String ID:
API String ID: 4145324106-0
Opcode ID: f4a4373b3807e40d059ff1a41e18649debdfb38645ab18bb5f5ee8a09aa56d8a
Instruction ID: 6fec285ca0f9bd0eb33fb2eaf678ae2f1c6b6aca2c4c1bab0ea33d8999623afa
Opcode Fuzzy Hash: f4a4373b3807e40d059ff1a41e18649debdfb38645ab18bb5f5ee8a09aa56d8a
Instruction Fuzzy Hash: EC8139B5A083419FC724CF69CA8495BFBE9BFD8714F14991DF988D7315DA30E8048B62

Function 00ED068E Relevance: 10.6, APIs: 7, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00ED0F17
_crt_debugger_hook.MSVCR90(00000001), ref: 00ED0F24
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00ED0F2C
UnhandledExceptionFilter.KERNEL32(00EE9F60), ref: 00ED0F37
_crt_debugger_hook.MSVCR90(00000001), ref: 00ED0F48
GetCurrentProcess.KERNEL32(C0000409), ref: 00ED0F53
TerminateProcess.KERNEL32(00000000), ref: 00ED0F5A

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 8c32b684ba012cb7c4971f4ab928ecd053efd440482b0da796a669f072e16c11
Instruction ID: 43b04633945b1b6f71290e1ad1a1cc79661a58e125cfd5a63d8ceb65fa834a04
Opcode Fuzzy Hash: 8c32b684ba012cb7c4971f4ab928ecd053efd440482b0da796a669f072e16c11
Instruction Fuzzy Hash: 14212FBC811288DFC310DF29F9496583BE0FB6A3A0F00112AEE08A3360E77049C9EF51

Function 00E65850 Relevance: 7.7, APIs: 5, Instructions: 208windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90(?,?,?,?), ref: 00E6586E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapInfo
String ID:
API String ID: 1006323486-0
Opcode ID: dfa71c563fdd3f86abd36ff0c39452d42d3ac65bfe0902dbcc75e132f7b123fb
Instruction ID: f5b5e35a8f5e39a7ec1d66526509653c89d5cf5f55cd20a4d0438053c89b47b6
Opcode Fuzzy Hash: dfa71c563fdd3f86abd36ff0c39452d42d3ac65bfe0902dbcc75e132f7b123fb
Instruction Fuzzy Hash: 0C8146B6A083519FC714CF68D980A5BFBE5BFC8754F149A1DF988A7305D630E904CB92

Function 00E78D90 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdec504425249df7d768f905e9567903412de52609390fe5c2a96d9cc199017
Instruction ID: 89847ca70b941f44c9eee74ec84d06175dc28256ed6ce36ff4ed4e2ac50333d2
Opcode Fuzzy Hash: 1bdec504425249df7d768f905e9567903412de52609390fe5c2a96d9cc199017
Instruction Fuzzy Hash: A661B071648701AFD314DB28D980E6BB7E9AFD8744F109A1CF99993310EB31E945CBA2

Function 00E50320 Relevance: 7.7, APIs: 5, Instructions: 160windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E50355

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BindBitmapClip
String ID:
API String ID: 1740425945-0
Opcode ID: 8c2b9b6f03b03113ad301b9e3c89bb8990896b0c1c6f59870a87990803d84128
Instruction ID: 5362ee903ce0412f61b8280e8b431b5d3e97dd55afb2b04d53d9a8b1133192aa
Opcode Fuzzy Hash: 8c2b9b6f03b03113ad301b9e3c89bb8990896b0c1c6f59870a87990803d84128
Instruction Fuzzy Hash: 985149B2608305AFD304DF68DD81D3BB7E9EBC8754F009A1DFA9593241E670ED058B62

Function 00E4FB70 Relevance: 7.6, APIs: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E4FB94
OffsetRect.USER32(?,?,?), ref: 00E4FBD3
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E4FCAD

Part of subcall function 00E4F640: OffsetRect.USER32(?,?,00000000), ref: 00E4F672

OffsetRect.USER32(?,?,?), ref: 00E4FC18
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E4FC7E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapOffsetRect$Release$BindClip
String ID:
API String ID: 56185755-0
Opcode ID: c138b3859e28863213b7dd53d33d5120f26a3d7cad942a0e14fe432f82d3858c
Instruction ID: cd625a7c25df0f5a1cc6d8bb507edabf02eb86b270eb485877d6a838a061ee33
Opcode Fuzzy Hash: c138b3859e28863213b7dd53d33d5120f26a3d7cad942a0e14fe432f82d3858c
Instruction Fuzzy Hash: 774136B5608201AFC304DB98D881D6BF7E8EFC9754F008A1DFA8993351E775E905CBA2

Function 00E7C130 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7C145
GetVersionExW.KERNEL32 ref: 00E7C15A

Strings

Microsoft YaHei, xrefs: 00E7C173
Microsoft YaHei UI, xrefs: 00E7C16C

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Versionmemset
String ID: Microsoft YaHei$Microsoft YaHei UI
API String ID: 3136939366-2872549853
Opcode ID: af240b3f3b756ae1c6ecc38d7fd274cfe154faaa2fdce109c628de638b036d74
Instruction ID: f19275a2fdc9be8b5d9742f19f35beacdf05a8ac3e45bee65342aea0c8ea0c54
Opcode Fuzzy Hash: af240b3f3b756ae1c6ecc38d7fd274cfe154faaa2fdce109c628de638b036d74
Instruction Fuzzy Hash: EBF096B1004302AFC314DF54D846ACBB7E8EBD4744F40892EF199A6251D370D64DCB93

Function 00E56A40 Relevance: 6.4, APIs: 4, Instructions: 436windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90 ref: 00E56A59
XL_GetLogPen.MSVCR90(?,?), ref: 00E56A93
XL_GetBitmapBuffer.MSVCR90(?,?,?), ref: 00E56B3B
XL_GetBitmapBuffer.MSVCR90(?,?,?), ref: 00E56CB0

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$Buffer$Info
String ID:
API String ID: 2298774921-0
Opcode ID: 77385198f69d207c2325dc620f0e61cd3cfaccd21374a56c6ee2e24ec6390062
Instruction ID: e25dd3a6752832f740c6c1533bf485d77b872d90da408c7166b033325d263436
Opcode Fuzzy Hash: 77385198f69d207c2325dc620f0e61cd3cfaccd21374a56c6ee2e24ec6390062
Instruction Fuzzy Hash: E9028F71A0C7418BE3649F2AD59026ABBE1FBC4741F604D2DF9E5D3271EA348848DF92

Function 00E56470 Relevance: 6.4, APIs: 4, Instructions: 426windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90 ref: 00E56489
XL_GetLogPen.MSVCR90(?,?), ref: 00E564C3
XL_GetBitmapBuffer.MSVCR90(?,?,?), ref: 00E56580
XL_GetBitmapBuffer.MSVCR90(?,?,?), ref: 00E566EB

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$Buffer$Info
String ID:
API String ID: 2298774921-0
Opcode ID: c042ba07220fc7550f530ee59ea500c3c068ca9c93dcd733ade7a2672e8ac355
Instruction ID: 8eda2cc85b8750008e779506a8015c70345f8657351b9ddfa951cf86daefdea9
Opcode Fuzzy Hash: c042ba07220fc7550f530ee59ea500c3c068ca9c93dcd733ade7a2672e8ac355
Instruction Fuzzy Hash: 9A027071A0C7418BE364DF26C55026ABBE0FBC8741F608E2DF9D5D2275EA348858DF92

Function 00E4F8B0 Relevance: 6.1, APIs: 4, Instructions: 136windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E4F8D3
OffsetRect.USER32(?,?,?), ref: 00E4F92A
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E4F9A3

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipOffsetRectRelease
String ID:
API String ID: 643899227-0
Opcode ID: bea822af3f339cffe914cd3c4951774d9b36f86e39c87ae082a8a33ae9f397fc
Instruction ID: f984cd707f6fc869085599c0568ab7d07de51c9c1920064cb7419ae969f086f3
Opcode Fuzzy Hash: bea822af3f339cffe914cd3c4951774d9b36f86e39c87ae082a8a33ae9f397fc
Instruction Fuzzy Hash: 50415A76618200AFD204DBA8ED81D6BB7E9EFD9750F004A1DFA85A3210D670EC05CBA2

Function 00E4FA10 Relevance: 6.1, APIs: 4, Instructions: 128windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E4FA33
OffsetRect.USER32(?,?,?), ref: 00E4FAB7
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E4FB1E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipOffsetRectRelease
String ID:
API String ID: 643899227-0
Opcode ID: 7ce5579585afdb463b72e23e67fbee42a7f2dede60fbda45a5661793715f7364
Instruction ID: fc5b4442d40b03c939fec6cd46168da2d523087b33af7f275a8f0285978c4d8e
Opcode Fuzzy Hash: 7ce5579585afdb463b72e23e67fbee42a7f2dede60fbda45a5661793715f7364
Instruction Fuzzy Hash: 19418E72608300AFC304EB64EC81D6BB7E8FFD5314F04592DFA4597211EA75E905CBA2

Function 00E661C0 Relevance: 4.5, APIs: 3, Instructions: 21windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E661CB
XL_CloneBitmap.MSVCR90(00000000), ref: 00E661DA
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E661E2

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipCloneRelease
String ID:
API String ID: 4113513451-0
Opcode ID: 75aa3c4776f7021bcbfea384dd8f25f194866336b6060afae45f49d256920bd7
Instruction ID: 676b2c5d48350bb6d700d535f95fdb279db1585b0770f487758068dcf5eb20ad
Opcode Fuzzy Hash: 75aa3c4776f7021bcbfea384dd8f25f194866336b6060afae45f49d256920bd7
Instruction Fuzzy Hash: 6ED05226B0A230338632A229BC00C9F26CE8FC62A07022429F884AB205CA20CC4682E0

Function 00E50060 Relevance: 3.1, APIs: 2, Instructions: 126windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E500BC

Part of subcall function 00E4F530: OffsetRect.USER32(?,?,?), ref: 00E4F53F

XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E501A0

Part of subcall function 00E4F640: OffsetRect.USER32(?,?,00000000), ref: 00E4F672

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapOffsetRect$BindClipRelease
String ID:
API String ID: 1744652866-0
Opcode ID: 402daf36f6a3317bc806c2e1c3153f908f16a996d6ccecf3e2a32d9cb3fc0a99
Instruction ID: af886d0213c7b3597f985b85d676b4d97179d6a5cdb66a87dc2d31a59883a1a9
Opcode Fuzzy Hash: 402daf36f6a3317bc806c2e1c3153f908f16a996d6ccecf3e2a32d9cb3fc0a99
Instruction Fuzzy Hash: 634117B66083059FC314DF58D88096BB7E8EBC8704F049A2DF99997340E770E909CBA2

Function 00E501C0 Relevance: 3.1, APIs: 2, Instructions: 126windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?), ref: 00E5021C

Part of subcall function 00E4F530: OffsetRect.USER32(?,?,?), ref: 00E4F53F

XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E50300

Part of subcall function 00E4F640: OffsetRect.USER32(?,?,00000000), ref: 00E4F672

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapOffsetRect$BindClipRelease
String ID:
API String ID: 1744652866-0
Opcode ID: dc940fec47099a3351a195f0ecbf8aeb0a00f46d9b282c4388ad2da4a0933bca
Instruction ID: 623a98642e358f7653ccab8e555351b1ba0c9f93ea74f89db5d6df172b02da2c
Opcode Fuzzy Hash: dc940fec47099a3351a195f0ecbf8aeb0a00f46d9b282c4388ad2da4a0933bca
Instruction Fuzzy Hash: F94106B66083059FC714DF58D88096BB7E8EBC8714F049A2DF99597211E770E909CBA2

Function 00E662B0 Relevance: 3.0, APIs: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

XL_ClipSubBindBitmap.MSVCR90(?,?,?,?,?,?,?,?,?,?,?,00E4EC85,?,?,?,?), ref: 00E662EF
XL_ReleaseBitmap.MSVCR90(00000000), ref: 00E6631A

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipRelease
String ID:
API String ID: 1818060704-0
Opcode ID: 70989ceba9ff90ba7ef9a9b2b3ae4549e3bf5ca0fc554327bac36dde81eafe45
Instruction ID: ecfaa38bd5a6cc4fd4d5466298acdf129bcb5995e658a334e7ca3d558c378444
Opcode Fuzzy Hash: 70989ceba9ff90ba7ef9a9b2b3ae4549e3bf5ca0fc554327bac36dde81eafe45
Instruction Fuzzy Hash: 5701D4756197419FE314DE19E840A6B7BE8AFD4348F88595CF885E3341D231DE0987E2

Function 00E65CD0 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

XL_ReleaseBitmap.MSVCR90(?,?,00E657B7,00000000,?), ref: 00E65CDD
XL_ClipSubBindBitmap.MSVCR90(00E657B7,00000004,?,00E657B7,00000000,?), ref: 00E65CF6

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$BindClipRelease
String ID:
API String ID: 1818060704-0
Opcode ID: 44cab5d4934c3f6c8bc56b6c661d22e732d9582e48bf6f731e4438de23726368
Instruction ID: 8f7518488460e721a13a4d86e34a36e9fd8d73de3b73f105fc5aad23b0496616
Opcode Fuzzy Hash: 44cab5d4934c3f6c8bc56b6c661d22e732d9582e48bf6f731e4438de23726368
Instruction Fuzzy Hash: BAE01A717047015BE724DF3AE884B8763ECAF50350F088819B441D3695E671E88486D0

Function 00E66130 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

XL_BindExpRect.MSVCR90(?,?,?,?,00E656E6,?,?), ref: 00E66142
XL_BindExpRect.MSVCR90(?,?,?,?,00E656E6,?,?), ref: 00E66150

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BindRect
String ID:
API String ID: 2019094475-0
Opcode ID: 4b8fd226f3addc3fdf90616bf6a4184bb0316d0dd5ee8a8a8c43bbf9cadb2198
Instruction ID: 5bfebff03a962780c934d422bf8f78cfdc26946d95d18f6795868ae7c631d2da
Opcode Fuzzy Hash: 4b8fd226f3addc3fdf90616bf6a4184bb0316d0dd5ee8a8a8c43bbf9cadb2198
Instruction Fuzzy Hash: 56D0177121021167CA20DF2AA804F57A3EC9FC2B50B05181EB884E3201C660E8828660

Function 00E65D10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

XL_BindRectExpRect.MSVCR90(?,?,00E6566D,00000000,00000010,00000000,00000000,00000000,00000000,00000000,?,00000000,?K,00000000,$5,?), ref: 00E65D1D

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Rect$Bind
String ID:
API String ID: 4222664859-0
Opcode ID: 6147755cd78e518258e8b2ca34b8b3c3d0b968d40479dc93a9ec394fccc8ecea
Instruction ID: 76d59aa0e5501ca326d315694e5b2e5471649e90e68ff76a7d3c59314fbe0aed
Opcode Fuzzy Hash: 6147755cd78e518258e8b2ca34b8b3c3d0b968d40479dc93a9ec394fccc8ecea
Instruction Fuzzy Hash: D5C09B752552067BC604DE34C580C3777E59BC4700F209A4C7445C7285CA31EC029651

Function 00EC6640 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

V, xrefs: 00EC664A, 00EC664D

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-4045069856
Opcode ID: 3e8acc0491f1bd458dbe986156547753bb56667531292b4c8114fba2563db1c8
Instruction ID: 0be3e45cfc99a3d24a49909e1cc02a83dca486df300fe4f4b2a1602233b4459e
Opcode Fuzzy Hash: 3e8acc0491f1bd458dbe986156547753bb56667531292b4c8114fba2563db1c8
Instruction Fuzzy Hash: B8D0A77055410CAB4704DF68D901D7D73E8D708310B004259B849C7280DA319E049790

Function 00E4F780 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41eb3fd90b5308b96c56c905c3d34159dce1ebdfe3e9f6c08fdaf027db7f4308
Instruction ID: a135b9d59f2f5d3c5aeba87593047b5a461a7b840bef79cc14cc9ab7ff7def40
Opcode Fuzzy Hash: 41eb3fd90b5308b96c56c905c3d34159dce1ebdfe3e9f6c08fdaf027db7f4308
Instruction Fuzzy Hash: 4CF021327046205BC620DA54E804F6BA3D58BC4F14F01592EF846A3281C624AD8182E1

Function 00E4F720 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2c1d442d84a7a808d06f4ab331a4dfc0a37c68a27340e1d96532c91d6b5d9e
Instruction ID: 45ffa5ff3b178082f39203d1f34f41c2662d152a46165a7b01346f2869e198fe
Opcode Fuzzy Hash: ef2c1d442d84a7a808d06f4ab331a4dfc0a37c68a27340e1d96532c91d6b5d9e
Instruction Fuzzy Hash: 1CF0E2767147006BE720EA75E809F27B3E5AFC4F10F05A92EE84AA3241E634EC418361

Function 00EC6890 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3389852d1fce04afb35b551b3a5aef72c403d44c229d5823b8480bc7a1563a4b
Instruction ID: 438ec9a94439f1b1c5a270e3a4a77faca5947b43d26ef67f13af5c122c0fcdb3
Opcode Fuzzy Hash: 3389852d1fce04afb35b551b3a5aef72c403d44c229d5823b8480bc7a1563a4b
Instruction Fuzzy Hash: 05E0C27151410DEBCB08DEA8DE00EBEB3E49B48300F00925CB806D7280DA319E10D790

Function 00EC6610 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854f2b8601897dd40b6e6c6cd5658ef0193a4cbaa0a446e6b97a2db865c207b8
Instruction ID: 9d03705ec4cc07d2ae057eb1b9223f6ad4a60090c4e9e376110565fe4d5ea661
Opcode Fuzzy Hash: 854f2b8601897dd40b6e6c6cd5658ef0193a4cbaa0a446e6b97a2db865c207b8
Instruction Fuzzy Hash: D7D05E7165410DAB8B04CFA9DD41D7EB3E8EB48310B00825DB809C7280DA31AE109BA0

Function 00E4F2B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e693d08852d6a50c49319eb2e8c6b7a4c74d1bb6424840a3f2781e76101f8866
Instruction ID: 68f8da6a624f3b8822e71120b453185dd4e21e11fc423cf664fb6641510715bc
Opcode Fuzzy Hash: e693d08852d6a50c49319eb2e8c6b7a4c74d1bb6424840a3f2781e76101f8866
Instruction Fuzzy Hash: 70D09EF5618301AFD204DE09D885E2BB3E9ABD4610F41CD0CB59982251D375D918DB72

Function 00E4DF00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913416019ee1888ff84295e56f63eeeea62e606f838235b0179ba7ac94dadca3
Instruction ID: 7ca08c7f22d5f9ceb13778137b041f994ab5147ec667205d62d77403ce3d1ee2
Opcode Fuzzy Hash: 913416019ee1888ff84295e56f63eeeea62e606f838235b0179ba7ac94dadca3
Instruction Fuzzy Hash: 77C08C34309201528A64EA62A844E2FA3C82FA0749B44E82D3486E2805CA20EC18D660

Function 00ECFF40 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa0f1363769a7409018670b2ad7eb92055c24e737308c12408d7f4aa4e0df5f
Instruction ID: e0677a5a359e6f8f868840db47d58da2bf60d5ad5f9a33f79f92eb6480f7a126
Opcode Fuzzy Hash: 7fa0f1363769a7409018670b2ad7eb92055c24e737308c12408d7f4aa4e0df5f
Instruction Fuzzy Hash:

Function 00FE3190 Relevance: 80.7, APIs: 38, Strings: 8, Instructions: 212COMMON

Download Yara Rule

APIs

lua_type.XLLUARUNTIME(?,00000001), ref: 00FE319B
_time64.MSVCR90 ref: 00FE31A9
luaL_checktype.XLLUARUNTIME(?,00000001,00000005), ref: 00FE31BD
lua_settop.XLLUARUNTIME(?,00000001,?,00000001,00000005), ref: 00FE31C5
lua_getfield.XLLUARUNTIME(?,000000FF,sec,?,00000001,?,00000001,00000005), ref: 00FE31D2
lua_isnumber.XLLUARUNTIME(?,000000FF,?,000000FF,sec,?,00000001,?,00000001,00000005), ref: 00FE31DA
lua_tointeger.XLLUARUNTIME(?,000000FF), ref: 00FE31E9
lua_settop.XLLUARUNTIME(?,000000FE), ref: 00FE31FA
lua_getfield.XLLUARUNTIME(?,000000FF,min,?,000000FE), ref: 00FE320B
lua_isnumber.XLLUARUNTIME(?,000000FF,?,000000FF,min,?,000000FE), ref: 00FE3213
lua_tointeger.XLLUARUNTIME(?,000000FF), ref: 00FE3222
lua_settop.XLLUARUNTIME(?,000000FE), ref: 00FE3233
lua_getfield.XLLUARUNTIME(?,000000FF,hour,?,000000FE), ref: 00FE3244
lua_isnumber.XLLUARUNTIME(?,000000FF,?,000000FF,hour,?,000000FE), ref: 00FE324C
lua_tointeger.XLLUARUNTIME(?,000000FF), ref: 00FE325B
lua_settop.XLLUARUNTIME(?,000000FE), ref: 00FE326F
lua_getfield.XLLUARUNTIME(?,000000FF,day,?,000000FE), ref: 00FE3280
lua_isnumber.XLLUARUNTIME(?,000000FF,?,000000FF,day,?,000000FE), ref: 00FE3288
lua_tointeger.XLLUARUNTIME(?,000000FF), ref: 00FE3297
lua_settop.XLLUARUNTIME(?,000000FE,?,000000FF), ref: 00FE32A1
lua_getfield.XLLUARUNTIME(?,000000FF,month), ref: 00FE32CC
lua_isnumber.XLLUARUNTIME(?,000000FF,?,000000FF,month), ref: 00FE32D4
lua_pushnil.XLLUARUNTIME(?), ref: 00FE33BB
lua_pushnumber.XLLUARUNTIME(?), ref: 00FE33D8

Strings

min, xrefs: 00FE31FF
sec, xrefs: 00FE31CA
year, xrefs: 00FE330C, 00FE3346
month, xrefs: 00FE32C0, 00FE32F9
isdst, xrefs: 00FE3359
hour, xrefs: 00FE3238
day, xrefs: 00FE3274, 00FE32AD
field '%s' missing in date table, xrefs: 00FE32B2, 00FE32FE, 00FE334B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfieldlua_isnumberlua_settop$lua_tointeger$L_checktype_time64lua_pushnillua_pushnumberlua_type
String ID: day$field '%s' missing in date table$hour$isdst$min$month$sec$year
API String ID: 1683707124-428864666
Opcode ID: 8405a0bc86e45f251841671fc8b28e2353ad974b0ab2ae9dc4dd72e5bb1b37ad
Instruction ID: 939433230d5d907cf1a6279c95a34dc43f912ee7af088bd14f3c85c837b1e8bc
Opcode Fuzzy Hash: 8405a0bc86e45f251841671fc8b28e2353ad974b0ab2ae9dc4dd72e5bb1b37ad
Instruction Fuzzy Hash: 63515072919A2176DA0136291C0BF6E345A0E47B76FBC0716F434B23E6FE69920171AB

Function 00FE24F0 Relevance: 80.6, APIs: 31, Strings: 15, Instructions: 150COMMON

Download Yara Rule

APIs

luaL_newmetatable.XLLUARUNTIME(?,_LOADLIB), ref: 00FE24FC

Part of subcall function 00FD65E0: lua_getfield.XLLUARUNTIME(00000000,FFFFD8F0,?,?,00000000,00FC3332,00000000,?,00000000,00000000,00000000,00FD2F36,?,?,00000000,00000000), ref: 00FD65F1
Part of subcall function 00FD65E0: lua_type.XLLUARUNTIME(00000000,000000FF,00000000,FFFFD8F0,?,?,00000000,00FC3332,00000000,?,00000000,00000000,00000000,00FD2F36,?,?), ref: 00FD65F9

lua_pushcclosure.XLLUARUNTIME(?,00FE1C10,00000000,?,_LOADLIB), ref: 00FE2509
lua_setfield.XLLUARUNTIME(?,000000FE,__gc,?,00FE1C10,00000000,?,_LOADLIB), ref: 00FE2516
luaL_register.XLLUARUNTIME(?,package,00FF2EE4,?,000000FE,__gc,?,00FE1C10,00000000,?,_LOADLIB), ref: 00FE2526

Part of subcall function 00FD7600: luaL_openlib.XLLUARUNTIME(?,?,?,00000000,00FCFEB5,00000000,Xunlei.LuaRuntime.Int64,00FF1960,?,?,00FD0161,?), ref: 00FD7611

lua_pushvalue.XLLUARUNTIME(?,000000FF,?,package,00FF2EE4,?,000000FE,__gc,?,00FE1C10,00000000,?,_LOADLIB), ref: 00FE252E
lua_replace.XLLUARUNTIME(?,FFFFD8EF,?,000000FF,?,package,00FF2EE4,?,000000FE,__gc,?,00FE1C10,00000000,?,_LOADLIB), ref: 00FE2539
lua_createtable.XLLUARUNTIME(?,00000000,00000004,?,FFFFD8EF,?,000000FF,?,package,00FF2EE4,?,000000FE,__gc,?,00FE1C10,00000000), ref: 00FE2543
lua_pushcclosure.XLLUARUNTIME(?,00FE2070,00000000), ref: 00FE255A
lua_rawseti.XLLUARUNTIME(?,000000FE,00000001,?,00FE2070,00000000), ref: 00FE2564
lua_setfield.XLLUARUNTIME(?,000000FE,loaders), ref: 00FE257F
getenv.MSVCR90 ref: 00FE258F
lua_pushstring.XLLUARUNTIME(?,.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua), ref: 00FE259E
luaL_gsub.XLLUARUNTIME(?,00000000,00FF3134,00FF3138), ref: 00FE25B4
luaL_gsub.XLLUARUNTIME(?,00000000,00FF3130,.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua,?,00000000,00FF3134,00FF3138), ref: 00FE25C5
lua_remove.XLLUARUNTIME(?,000000FE,?,00000000,00FF3130,.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua,?,00000000,00FF3134,00FF3138), ref: 00FE25CD
lua_setfield.XLLUARUNTIME(?,000000FE,path), ref: 00FE25E2
getenv.MSVCR90 ref: 00FE25EC
lua_pushstring.XLLUARUNTIME(?,.\?.dll;!\?.dll;!\loadall.dll), ref: 00FE25FB
luaL_gsub.XLLUARUNTIME(?,00000000,00FF3134,00FF3138), ref: 00FE2611
luaL_gsub.XLLUARUNTIME(?,00000000,00FF3130,.\?.dll;!\?.dll;!\loadall.dll,?,00000000,00FF3134,00FF3138), ref: 00FE2622
lua_remove.XLLUARUNTIME(?,000000FE,?,00000000,00FF3130,.\?.dll;!\?.dll;!\loadall.dll,?,00000000,00FF3134,00FF3138), ref: 00FE262A
lua_setfield.XLLUARUNTIME(?,000000FE,cpath), ref: 00FE263F
lua_pushlstring.XLLUARUNTIME(?,\;?!-,00000009,?,000000FE,cpath), ref: 00FE264C
lua_setfield.XLLUARUNTIME(?,000000FE,config,?,\;?!-,00000009,?,000000FE,cpath), ref: 00FE2659
luaL_findtable.XLLUARUNTIME(?,FFFFD8F0,_LOADED,00000002,?,000000FE,config,?,\;?!-,00000009,?,000000FE,cpath), ref: 00FE266B
lua_setfield.XLLUARUNTIME(?,000000FE,loaded,?,FFFFD8F0,_LOADED,00000002,?,000000FE,config,?,\;?!-,00000009,?,000000FE,cpath), ref: 00FE2678
lua_createtable.XLLUARUNTIME(?,00000000,00000000), ref: 00FE2685
lua_setfield.XLLUARUNTIME(?,000000FE,preload,?,00000000,00000000), ref: 00FE2692
lua_pushvalue.XLLUARUNTIME(?,FFFFD8EE,?,000000FE,preload,?,00000000,00000000), ref: 00FE269D
luaL_register.XLLUARUNTIME(?,00000000,00FF2EFC,?,FFFFD8EE,?,000000FE,preload,?,00000000,00000000), ref: 00FE26AA
lua_settop.XLLUARUNTIME(?,000000FE,?,00000000,00FF2EFC,?,FFFFD8EE,?,000000FE,preload,?,00000000,00000000), ref: 00FE26B2

Strings

loaded, xrefs: 00FE2670
loaders, xrefs: 00FE2577
.\?.dll;!\?.dll;!\loadall.dll, xrefs: 00FE25F5, 00FE2616
path, xrefs: 00FE25DA
_LOADLIB, xrefs: 00FE24F6
package, xrefs: 00FE2520
\;?!-, xrefs: 00FE2646
LUA_PATH, xrefs: 00FE258A
preload, xrefs: 00FE268A
cpath, xrefs: 00FE2637
__gc, xrefs: 00FE250E
LUA_CPATH, xrefs: 00FE25E7
config, xrefs: 00FE2651
_LOADED, xrefs: 00FE2660
.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua, xrefs: 00FE2598, 00FE25B9

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_setfield$L_gsub$L_registergetenvlua_createtablelua_pushcclosurelua_pushstringlua_pushvaluelua_remove$L_findtableL_newmetatableL_openliblua_getfieldlua_pushlstringlua_rawsetilua_replacelua_settoplua_type
String ID: .\?.dll;!\?.dll;!\loadall.dll$.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua$LUA_CPATH$LUA_PATH$\;?!-$_LOADED$_LOADLIB$__gc$config$cpath$loaded$loaders$package$path$preload
API String ID: 2371021541-613600958
Opcode ID: 22c294358d33ebdd2d410de7f34073fbdb5e6a028e16649f7bd3743fede13ab5
Instruction ID: a7135c27c0c92a82c3a6f8a83bbdcc0fe39ad8c23b66045d2473bf96719eb1e4
Opcode Fuzzy Hash: 22c294358d33ebdd2d410de7f34073fbdb5e6a028e16649f7bd3743fede13ab5
Instruction Fuzzy Hash: E6310170A8AA7931D55272251D03FAF340E0F93F65F680302F621742E2AE9DB71230AF

Function 00FE20E0 Relevance: 61.4, APIs: 30, Strings: 5, Instructions: 163COMMON

Download Yara Rule

APIs

luaL_checklstring.XLLUARUNTIME(?,00000001,00000000), ref: 00FE20EB

Part of subcall function 00FD70D0: lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
Part of subcall function 00FD70D0: lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
Part of subcall function 00FD70D0: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

lua_settop.XLLUARUNTIME(?,00000001,?,00000001,00000000), ref: 00FE20F5
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 00FE2105
lua_getfield.XLLUARUNTIME(?,00000002,00000000,?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 00FE210E
lua_toboolean.XLLUARUNTIME(?,000000FF,?,00000002,00000000,?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 00FE2116
lua_touserdata.XLLUARUNTIME(?,000000FF), ref: 00FE2125
luaL_error.XLLUARUNTIME(?,loop or previous error loading module '%s',00000000), ref: 00FE213F

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

lua_getfield.XLLUARUNTIME(?,FFFFD8EF,loaders), ref: 00FE215A
lua_type.XLLUARUNTIME(?,000000FF,?,FFFFD8EF,loaders), ref: 00FE2162
luaL_error.XLLUARUNTIME(?,'package.loaders' must be a table), ref: 00FE2175
lua_pushlstring.XLLUARUNTIME(?,00FF17D3,00000000), ref: 00FE2186
lua_rawgeti.XLLUARUNTIME(?,000000FE,00000001), ref: 00FE2197
lua_type.XLLUARUNTIME(?,000000FF,?,000000FE,00000001), ref: 00FE219F
lua_tolstring.XLLUARUNTIME(?,000000FE,00000000), ref: 00FE21AF
luaL_error.XLLUARUNTIME(?,module '%s' not found:%s,00000000,00000000,?,000000FE,00000000), ref: 00FE21BC
lua_pushstring.XLLUARUNTIME(?,00000000), ref: 00FE21C6
lua_type.XLLUARUNTIME(?,000000FF,?,00000001,00000001,?,00000000), ref: 00FE21D8
lua_isstring.XLLUARUNTIME(?,000000FF), ref: 00FE21E8
lua_concat.XLLUARUNTIME(?,00000002), ref: 00FE21F7
lua_settop.XLLUARUNTIME(?,000000FE), ref: 00FE2205
lua_pushlightuserdata.XLLUARUNTIME(?,00FF2EE0), ref: 00FE2216
lua_setfield.XLLUARUNTIME(?,00000002,00000000,?,00FF2EE0), ref: 00FE221F
lua_pushstring.XLLUARUNTIME(?,00000000,?,00000002,00000000,?,00FF2EE0), ref: 00FE2226
lua_type.XLLUARUNTIME(?,000000FF,?,00000001,00000001,?,00000000,?,00000002,00000000,?,00FF2EE0), ref: 00FE2238
lua_setfield.XLLUARUNTIME(?,00000002,00000000), ref: 00FE2249

Strings

loaders, xrefs: 00FE214F
loop or previous error loading module '%s', xrefs: 00FE2139
'package.loaders' must be a table, xrefs: 00FE216F
_LOADED, xrefs: 00FE20FA
module '%s' not found:%s, xrefs: 00FE21B6

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_type$L_errorlua_getfield$lua_concatlua_pushstringlua_setfieldlua_settoplua_tolstringlua_typename$L_argerrorL_checklstringL_wherelua_errorlua_isstringlua_pushlightuserdatalua_pushlstringlua_pushvfstringlua_rawgetilua_tobooleanlua_touserdata
String ID: 'package.loaders' must be a table$_LOADED$loaders$loop or previous error loading module '%s'$module '%s' not found:%s
API String ID: 1807688677-732368299
Opcode ID: 82d3f40d7be7b91f3775870d808665f1180ddb58f85ef2c370cbac3c9bb8115e
Instruction ID: 1b478f0f3e6c7c25f04a20c44463da08e20ca84bed5e1d1791fe2592f249eba1
Opcode Fuzzy Hash: 82d3f40d7be7b91f3775870d808665f1180ddb58f85ef2c370cbac3c9bb8115e
Instruction Fuzzy Hash: CC413B65946E2531D92231296C47F9F311E4F53B36FAC0312FA24743E7EA8D974260BB

Function 00E4D940 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

png_create_read_struct_2.LIBPNG13(1.2.50,00000000,00000000,00000000,00000000,00E7F5A0,00E4D810,61C1F77A), ref: 00E4D983
png_create_info_struct.LIBPNG13(00000000,?,?,?,61C1F77A), ref: 00E4D993
png_destroy_read_struct.LIBPNG13(?,?,00000000,?,?,?,?,?,?,?,?,?,61C1F77A), ref: 00E4D9A8
_setjmp3.MSVCR90 ref: 00E4D9D8
png_set_read_fn.LIBPNG13(?,?,00E4D820,?,?,?,?,?,?,?,?,?,61C1F77A), ref: 00E4DA18
png_set_error_fn.LIBPNG13(?,00000000,00E4D850,00000000,?,?,00E4D820), ref: 00E4DA28
png_read_info.LIBPNG13(?,?,?,00000000,00E4D850,00000000,?,?,00E4D820), ref: 00E4DA35
png_set_strip_16.LIBPNG13(?), ref: 00E4DA4A
png_set_gray_to_rgb.LIBPNG13(?), ref: 00E4DA7B
png_set_palette_to_rgb.LIBPNG13(?,?), ref: 00E4DA84
png_set_palette_to_rgb.LIBPNG13(?), ref: 00E4DA96
png_set_palette_to_rgb.LIBPNG13(?), ref: 00E4DAA7
png_set_gray_to_rgb.LIBPNG13(?), ref: 00E4DAC5
png_set_palette_to_rgb.LIBPNG13(?,?), ref: 00E4DACE
png_set_filler.LIBPNG13(?,000000FF,00000001), ref: 00E4DAE1
png_set_bgr.LIBPNG13(?), ref: 00E4DAF6
png_read_update_info.LIBPNG13(?,?), ref: 00E4DB06
longjmp.MSVCR90(?,00000001), ref: 00E4DB84
png_read_image.LIBPNG13(?,00000000), ref: 00E4DBCC
png_destroy_read_struct.LIBPNG13(?,?,00000000), ref: 00E4DBEB

Strings

1.2.50, xrefs: 00E4D978

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: png_set_palette_to_rgb$png_destroy_read_structpng_set_gray_to_rgb$_setjmp3longjmppng_create_info_structpng_create_read_struct_2png_read_imagepng_read_infopng_read_update_infopng_set_bgrpng_set_error_fnpng_set_fillerpng_set_read_fnpng_set_strip_16
String ID: 1.2.50
API String ID: 388551500-3960229140
Opcode ID: 74a2dd845bcadbffd0d73888938f1b47b233889d18036908e08699d5c1ea4dec
Instruction ID: 1b3e2be0a971fbaea7eaea069877426235f5a538f078760a5d3ad0156d73e97f
Opcode Fuzzy Hash: 74a2dd845bcadbffd0d73888938f1b47b233889d18036908e08699d5c1ea4dec
Instruction Fuzzy Hash: 78A123B1E08218ABDF14EBA4EC86FBFB7B9EF84704F141569F509B7241D6319902C7A1

Function 00FC3090 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

luaL_checklstring.XLLUARUNTIME(?,00000001,00000000), ref: 00FC30A0

Part of subcall function 00FD70D0: lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
Part of subcall function 00FD70D0: lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
Part of subcall function 00FD70D0: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

lua_getfield.XLLUARUNTIME(?,FFFFD8F0,?), ref: 00FC3170
lua_type.XLLUARUNTIME(?,000000FF,?,FFFFD8F0,?), ref: 00FC3178
luaL_newmetatable.XLLUARUNTIME(?,?), ref: 00FC318A
lua_pushvalue.XLLUARUNTIME(?,000000FF,?,?), ref: 00FC3192
lua_setfield.XLLUARUNTIME(?,000000FE,__index,?,000000FF,?,?), ref: 00FC319F
lua_pushstring.XLLUARUNTIME(?,?,?,000000FE,__index,?,000000FF,?,?), ref: 00FC31AA
lua_setfield.XLLUARUNTIME(?,000000FE,__classname,?,?,?,000000FE,__index,?,000000FF,?,?), ref: 00FC31B7
luaL_register.XLLUARUNTIME(?,00000000,00000000,?,00000000,?,?), ref: 00FC31DD
lua_settop.XLLUARUNTIME(?,00000000), ref: 00FC31EE
lua_newuserdata.XLLUARUNTIME(?,00000004,?,00000000), ref: 00FC31F6
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,?,?,00000004,?,00000000), ref: 00FC320C
lua_setmetatable.XLLUARUNTIME(?,000000FE,?,FFFFD8F0,?,?,00000004,?,00000000), ref: 00FC3214
lua_pushboolean.XLLUARUNTIME(?,00000001,?,000000FE,?,FFFFD8F0,?,?,00000004,?,00000000), ref: 00FC321C

Part of subcall function 00FCB900: EnterCriticalSection.KERNEL32(?,?,?,?,00FD2B23), ref: 00FCB909
Part of subcall function 00FCB900: LeaveCriticalSection.KERNEL32(?,?,?,?,00FD2B23), ref: 00FCB919

lua_pushnil.XLLUARUNTIME(?), ref: 00FC3252
lua_pushboolean.XLLUARUNTIME(?,00000000,?), ref: 00FC325A

Part of subcall function 00FC2FC0: lua_getfield.XLLUARUNTIME(?,FFFFD8F0,XLLRT_RUNTIME,?,?,00FD2D5A,?), ref: 00FC2FD1
Part of subcall function 00FC2FC0: lua_touserdata.XLLUARUNTIME(?,000000FF,?,FFFFD8F0,XLLRT_RUNTIME,?,?,00FD2D5A,?), ref: 00FC2FD9
Part of subcall function 00FC2FC0: lua_settop.XLLUARUNTIME(?,000000FE,?,000000FF,?,FFFFD8F0,XLLRT_RUNTIME,?,?,00FD2D5A,?), ref: 00FC2FE3

Part of subcall function 00FCCC10: EnterCriticalSection.KERNEL32(00000024,E3DC3B0A,00000000,?,00000000,00000000,?,?,?,Function_0002FA00,000000FF,00FC30DB,?,00000000), ref: 00FCCC41
Part of subcall function 00FCCC10: LeaveCriticalSection.KERNEL32(00000024,?,?,?,?,?), ref: 00FCCD53

Strings

__classname, xrefs: 00FC31AF
__index, xrefs: 00FC3197

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: CriticalSection$lua_getfield$EnterLeavelua_pushbooleanlua_setfieldlua_settoplua_typelua_typename$L_argerrorL_checklstringL_newmetatableL_registerlua_newuserdatalua_pushnillua_pushstringlua_pushvaluelua_setmetatablelua_tolstringlua_touserdata
String ID: __classname$__index
API String ID: 3177069667-10037376
Opcode ID: 3328abddb1cd3c67d347c82df628eec2bcb9cc77a4fc8419b4679979011d459b
Instruction ID: e4926e12d789b26ee081a91f812ef8fc25486f151a898c85faff968528d204dc
Opcode Fuzzy Hash: 3328abddb1cd3c67d347c82df628eec2bcb9cc77a4fc8419b4679979011d459b
Instruction Fuzzy Hash: 8B41F4706047057BC710BB249D42F6F73AAAFC5720F18462DF90567392DE3CEA05A6EA

Function 00FD8190 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

luaL_checkany.XLLUARUNTIME(?,00000001), ref: 00FD8198

Part of subcall function 00FD70A0: lua_type.XLLUARUNTIME(?,?), ref: 00FD70AC
Part of subcall function 00FD70A0: luaL_argerror.XLLUARUNTIME(?,?,value expected), ref: 00FD70C0

luaL_callmeta.XLLUARUNTIME(?,00000001,__tostring,?,00000001), ref: 00FD81A5

Part of subcall function 00FD66D0: lua_gettop.XLLUARUNTIME(?), ref: 00FD66E8
Part of subcall function 00FD66D0: luaL_getmetafield.XLLUARUNTIME(?,?,?), ref: 00FD66FB

lua_type.XLLUARUNTIME(?,00000001), ref: 00FD81B8
lua_tolstring.XLLUARUNTIME(?,00000001,00000000), ref: 00FD81D1
lua_pushstring.XLLUARUNTIME(?,00000000,?,00000001,00000000), ref: 00FD81D8
lua_pushvalue.XLLUARUNTIME(?,00000001), ref: 00FD81EA
lua_toboolean.XLLUARUNTIME(?,00000001), ref: 00FD81FC
lua_pushstring.XLLUARUNTIME(?,true), ref: 00FD8214
lua_pushlstring.XLLUARUNTIME(?,nil,00000003), ref: 00FD822B
lua_topointer.XLLUARUNTIME(?,00000001), ref: 00FD823D
lua_type.XLLUARUNTIME(?,00000001,00000000), ref: 00FD8249
lua_typename.XLLUARUNTIME(?,00000000,?,00000001,00000000), ref: 00FD8250

Strings

__tostring, xrefs: 00FD819D
nil, xrefs: 00FD8225
%s: %p, xrefs: 00FD8259
true, xrefs: 00FD8206, 00FD8212
false, xrefs: 00FD820D

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_type$lua_pushstring$L_argerrorL_callmetaL_checkanyL_getmetafieldlua_gettoplua_pushlstringlua_pushvaluelua_tobooleanlua_tolstringlua_topointerlua_typename
String ID: %s: %p$__tostring$false$nil$true
API String ID: 1790956452-3663562000
Opcode ID: 17e726cc40ca8b80d8f57b69b982ecd8188df13cf8d171b9f309506e5ed8fad5
Instruction ID: 0514f93abe7e8a59d937b282d8a5b7070ca4f9494f6022d3eb2f52182617888f
Opcode Fuzzy Hash: 17e726cc40ca8b80d8f57b69b982ecd8188df13cf8d171b9f309506e5ed8fad5
Instruction Fuzzy Hash: 22112475A5192476FA6131187C43FEE310B4F12B17F8C0062F904A93C7E68E9B9631EB

Function 00E7FFF0 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 313registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E8004B
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,?,00000000), ref: 00E800A4
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,?,00000000), ref: 00E800BE
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E800C9
RegEnumValueW.ADVAPI32(?,?,?,?,00000000,?,?,?,?,00000000), ref: 00E80123
RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,?,00000000), ref: 00E801D7
lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00E801FC
RegEnumValueW.ADVAPI32(?,00000001,?,?,00000000,?,?,?), ref: 00E8023E
wcsncpy.MSVCR90 ref: 00E802CB
wcsrchr.MSVCR90 ref: 00E80304
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E80355
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E8035C

Strings

), xrefs: 00E802EF
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts, xrefs: 00E8006A
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink, xrefs: 00E80055

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: CloseEnumValue$Open$lstrcmpimemsetwcsncpywcsrchr
String ID: )$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
API String ID: 3496336313-354869487
Opcode ID: ddebd19692fc64350d4c9c70b494349ead3a41e5958e1e17693a236897c22065
Instruction ID: 5b3913ca7d15aca87e0c5ad9d3d43b3f73eda96b2047cad1945476f46bf054ba
Opcode Fuzzy Hash: ddebd19692fc64350d4c9c70b494349ead3a41e5958e1e17693a236897c22065
Instruction Fuzzy Hash: 2FB19EB2504340AFD760DF54D880AABB7E9FF88318F04592EF58EA7251D7709A49CB92

Function 00E651B0 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

sprintf.MSVCR90 ref: 00E652CB
sprintf.MSVCR90 ref: 00E6530D
sprintf.MSVCR90 ref: 00E65323
sprintf.MSVCR90 ref: 00E65375
sprintf.MSVCR90 ref: 00E65384
sprintf.MSVCR90 ref: 00E653CD
sprintf.MSVCR90 ref: 00E653E4
sprintf.MSVCR90 ref: 00E65427
sprintf.MSVCR90 ref: 00E65437

Strings

height-%d-(height-%d)/2, xrefs: 00E653C3
5, xrefs: 00E65285, 00E652EE, 00E65377, 00E6540D
width, xrefs: 00E652D6, 00E6532E, 00E6538F, 00E653F3, 00E65441
(height-%d)/2, xrefs: 00E65319
height-%d, xrefs: 00E65431
%d+(height-%d)/2, xrefs: 00E6536B, 00E653DE
$5, xrefs: 00E652B2

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: sprintf
String ID: 5$$5$%d+(height-%d)/2$(height-%d)/2$height-%d$height-%d-(height-%d)/2$width
API String ID: 590974362-916181144
Opcode ID: ddece58ff38ccbc74c8094dabe0b2c3d72550a21332be3d3cd8e87148770f8f0
Instruction ID: 6e59a4f6e482a9a0a2bee3793f35f0641507977d2a414f3d355b354065972574
Opcode Fuzzy Hash: ddece58ff38ccbc74c8094dabe0b2c3d72550a21332be3d3cd8e87148770f8f0
Instruction Fuzzy Hash: 1C9159B2608740AFC714CFA8D880C6FBBE9EBC8754F409A1EF59997260D670E905CB52

Function 00E64F00 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 234COMMON

Download Yara Rule

APIs

sprintf.MSVCR90 ref: 00E64FED
sprintf.MSVCR90 ref: 00E65033
sprintf.MSVCR90 ref: 00E65045
sprintf.MSVCR90 ref: 00E6509A
sprintf.MSVCR90 ref: 00E650A9
sprintf.MSVCR90 ref: 00E650F2
sprintf.MSVCR90 ref: 00E65109
sprintf.MSVCR90 ref: 00E6514B
sprintf.MSVCR90 ref: 00E6515B

Strings

5, xrefs: 00E64FDB, 00E65035, 00E6509C, 00E65132
%d+(width-%d)/2, xrefs: 00E65090, 00E65103
width-%d-(width-%d)/2, xrefs: 00E650E8
height, xrefs: 00E64FF3, 00E6504B, 00E650AF, 00E65113, 00E65160
width-%d, xrefs: 00E65155
$5, xrefs: 00E64FCA
(width-%d)/2, xrefs: 00E65025

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: sprintf
String ID: 5$$5$%d+(width-%d)/2$(width-%d)/2$height$width-%d$width-%d-(width-%d)/2
API String ID: 590974362-326185238
Opcode ID: 160b9943f7ccd368ae1b726f6a6f01a12de875852392edd02fa19288c9a6ff0d
Instruction ID: 9a74d1fb8d804d13e90d08ef8f703d09996aea6d8cdf40fbc330749e88cbf742
Opcode Fuzzy Hash: 160b9943f7ccd368ae1b726f6a6f01a12de875852392edd02fa19288c9a6ff0d
Instruction Fuzzy Hash: E6817FB2618340AFC714CF68D880DABF7E9FBC8754F509A1EF19993291D670E905CB92

Function 00FC41E0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 214windowCOMMON

Download Yara Rule

APIs

luaL_checklstring.XLLUARUNTIME(?,00000001,00000000,E3DC3B0A), ref: 00FC421F

Part of subcall function 00FD70D0: lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
Part of subcall function 00FD70D0: lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
Part of subcall function 00FD70D0: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

lua_tolstring.XLLUARUNTIME(?,00000002,00000000,?,00000001,00000000,E3DC3B0A), ref: 00FC422A
XLLRT_DebugCreateStackMemPool.XLLUARUNTIME(?), ref: 00FC42B2
XLLRT_DebugOutputLuaStack.XLLUARUNTIME(?,?), ref: 00FC42BD
XLLRT_DebugCreateLogs.XLLUARUNTIME(?), ref: 00FC42CB
XLLRT_DebugMemPoolGetLogs.XLLUARUNTIME(?,?,?), ref: 00FC42DA
XLLRT_DebugLogsPopNextLog.XLLUARUNTIME(?,?,?), ref: 00FC4306
XLLRT_DebugLogsPopNextLog.XLLUARUNTIME(?,?,?,?,?,?,?), ref: 00FC433E
XLLRT_DebugDestroyLogs.XLLUARUNTIME(?,?,?,?), ref: 00FC434C
XLLRT_DebugDesroyStackMemPool.XLLUARUNTIME(?,?,?,?), ref: 00FC4356
MessageBoxW.USER32(00000000,?,?,00000243), ref: 00FC4394

Strings

---Yes to check lua statck, No to debug, Cancel to ignore---, xrefs: 00FC435D
-----------lua stack-----------, xrefs: 00FC4458

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: Debug$Logs$PoolStack$CreateNextlua_tolstringlua_typename$DesroyDestroyL_argerrorL_checklstringMessageOutputlua_type
String ID: -----------lua stack-----------$---Yes to check lua statck, No to debug, Cancel to ignore---
API String ID: 1080134755-3212015147
Opcode ID: 996d0f8121b5ef8f794a346213b1b821cbb1b56029e71f5fe9cdd1115360d778
Instruction ID: 1ead067d8edf6d4c01d0f47948adbc8f50d12e80fd2ed5dff6f7c7cfeaffb0a0
Opcode Fuzzy Hash: 996d0f8121b5ef8f794a346213b1b821cbb1b56029e71f5fe9cdd1115360d778
Instruction Fuzzy Hash: 5871BEB19083819FD310DF64D992F6BB7E9AFC8710F44492EF58587241E778E908EB52

Function 00FD3160 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

lua_touserdata.XLLUARUNTIME(?,?,?,?,?,?,?,?,?), ref: 00FD3183
lua_objlen.XLLUARUNTIME(?,?), ref: 00FD31A1
lua_getmetatable.XLLUARUNTIME(?,?), ref: 00FD31E3
lua_getfield.XLLUARUNTIME(?,000000FF,__classname), ref: 00FD31FB
lua_tolstring.XLLUARUNTIME(?,000000FF,00000000,?,000000FF,__classname), ref: 00FD3205
lua_settop.XLLUARUNTIME(?,000000FD,00000000,?), ref: 00FD323C

Strings

__classname, xrefs: 00FD31F3
#, xrefs: 00FD32C5
", xrefs: 00FD32F4

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfieldlua_getmetatablelua_objlenlua_settoplua_tolstringlua_touserdata
String ID: "$#$__classname
API String ID: 1184533429-373965598
Opcode ID: a38e138ca8d3e9efad2decea748f8998cdb86e8a38b21738e41d6386bcc4daf4
Instruction ID: 1996a497fee98e3bb5bc7c152979a9f47a533effc2d9487bbf43a5b1190ea7ef
Opcode Fuzzy Hash: a38e138ca8d3e9efad2decea748f8998cdb86e8a38b21738e41d6386bcc4daf4
Instruction Fuzzy Hash: 7341B032B0530A57C600EB58EC86E6F73999FC5336F08062EF15157382DB3AD609A7E2

Function 00FD8470 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

lua_checkstack.XLLUARUNTIME ref: 00FD8481
lua_xmove.XLLUARUNTIME ref: 00FD84C0
lua_setlevel.XLLUARUNTIME ref: 00FD84C7
lua_resume.XLLUARUNTIME ref: 00FD84CE
lua_xmove.XLLUARUNTIME(?,?,00000001), ref: 00FD84E3
lua_gettop.XLLUARUNTIME ref: 00FD84F3
lua_checkstack.XLLUARUNTIME(?,00000001), ref: 00FD84FF
luaL_error.XLLUARUNTIME(?,too many arguments to resume), ref: 00FD8493

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

luaL_error.XLLUARUNTIME(?,too many results to resume), ref: 00FD8511
lua_xmove.XLLUARUNTIME(?,?,00000000), ref: 00FD851C

Strings

too many arguments to resume, xrefs: 00FD848D
too many results to resume, xrefs: 00FD850B
cannot resume %s coroutine, xrefs: 00FD84A8

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_xmove$L_errorlua_checkstack$L_wherelua_concatlua_errorlua_gettoplua_pushvfstringlua_resumelua_setlevel
String ID: cannot resume %s coroutine$too many arguments to resume$too many results to resume
API String ID: 3545457739-823306324
Opcode ID: f30648bbdf2490e9d68c55d4d9de7e89bcde0ab4d9bfddf816b511db16f0034b
Instruction ID: d83f996e40f6929bc816bf0e57212033d67c362860e63914eeb619e9f7e22ddf
Opcode Fuzzy Hash: f30648bbdf2490e9d68c55d4d9de7e89bcde0ab4d9bfddf816b511db16f0034b
Instruction Fuzzy Hash: D911E56690122537D51132783C87EBB335E8D93BA970C0227F904913A7FF4EA94170F6

Function 00EA71D0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 257stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,%!PS-Adobe-3.0 Resource-CIDFont,0000001F), ref: 00EA7229
strncmp.MSVCR90(?,StartData,00000009), ref: 00EA72C8
strncmp.MSVCR90(?,/sfnts,00000006), ref: 00EA72DF
memmove.MSVCR90 ref: 00EA72F5
strncmp.MSVCR90(?,StartData,00000009), ref: 00EA73E8
strncmp.MSVCR90(?,/sfnts,00000006), ref: 00EA7403
strncmp.MSVCR90(?,(Hex),00000005), ref: 00EA7490
atol.MSVCR90(?), ref: 00EA749E

Strings

%!PS-Adobe-3.0 Resource-CIDFont, xrefs: 00EA7223
(Hex), xrefs: 00EA748A
/sfnts, xrefs: 00EA72D9, 00EA73FD
StartData, xrefs: 00EA72C2, 00EA73E2

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp$atolmemmove
String ID: %!PS-Adobe-3.0 Resource-CIDFont$(Hex)$/sfnts$StartData
API String ID: 3562715906-2034626156
Opcode ID: 332c42ae18db65c55a063066384c0eae62766a787b399e5bdda3e21e790d2344
Instruction ID: 0c58dd65b5a4b044732eec600373aeba3fda20d83f6d8b07cb912bc94181d2b0
Opcode Fuzzy Hash: 332c42ae18db65c55a063066384c0eae62766a787b399e5bdda3e21e790d2344
Instruction Fuzzy Hash: 1281D4716083055FD720EF24DC84B6BB7E4EF89714F04452DFC99AB242E675FA0987A2

Function 00E649E0 Relevance: 21.2, APIs: 8, Strings: 6, Instructions: 240COMMON

Download Yara Rule

APIs

sprintf.MSVCR90 ref: 00E64B1D
sprintf.MSVCR90 ref: 00E64B70
sprintf.MSVCR90 ref: 00E64B7F
sprintf.MSVCR90 ref: 00E64BAF
sprintf.MSVCR90 ref: 00E64C05
sprintf.MSVCR90 ref: 00E64C13
sprintf.MSVCR90 ref: 00E64C29
sprintf.MSVCR90 ref: 00E64C37

Strings

5, xrefs: 00E64AFE, 00E64B72, 00E64B9D, 00E64BF3
width-(width-%d)/2-%d, xrefs: 00E64C31
height, xrefs: 00E64AB9
(width-%d)/2+%d, xrefs: 00E64C23
$5, xrefs: 00E64AB4
(width-%d)/2, xrefs: 00E64B13

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: sprintf
String ID: 5$$5$(width-%d)/2$(width-%d)/2+%d$height$width-(width-%d)/2-%d
API String ID: 590974362-2393546187
Opcode ID: 6076537683893df38e0dd59bdccd615bf697f8dbabb46c2e6684c1fd3fa584d4
Instruction ID: d80a86c3cc8a49ef3dca87dc2f261a12c488e06991648bde1c83438d023bddf6
Opcode Fuzzy Hash: 6076537683893df38e0dd59bdccd615bf697f8dbabb46c2e6684c1fd3fa584d4
Instruction Fuzzy Hash: F68105B1548341AFC710DF69EC84AABB7E8EFC8354F044A1EF59593291E731D908CBA2

Function 00E64C80 Relevance: 21.2, APIs: 8, Strings: 6, Instructions: 222COMMON

Download Yara Rule

APIs

sprintf.MSVCR90 ref: 00E64D9A
sprintf.MSVCR90 ref: 00E64DE1
sprintf.MSVCR90 ref: 00E64DFB
sprintf.MSVCR90 ref: 00E64E22
sprintf.MSVCR90 ref: 00E64E77
sprintf.MSVCR90 ref: 00E64E86
sprintf.MSVCR90 ref: 00E64E9C
sprintf.MSVCR90 ref: 00E64EAA

Strings

5, xrefs: 00E64D7B, 00E64DD4, 00E64E11, 00E64E66
height-(height-%d)/2-%d, xrefs: 00E64EA4
width, xrefs: 00E64D40
(height-%d)/2, xrefs: 00E64D90
(height-%d)/2+%d, xrefs: 00E64E96
$5, xrefs: 00E64D37

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: sprintf
String ID: 5$$5$(height-%d)/2$(height-%d)/2+%d$height-(height-%d)/2-%d$width
API String ID: 590974362-2187022414
Opcode ID: 6d49ed716881d0007edc7cf092bd15f62a8c28ca1cfe23a522e9dba8d9deeef7
Instruction ID: 24f8cc5d27505317a2011a2fe34ba8c120ec1af7cba787d01afbf0923a4eadff
Opcode Fuzzy Hash: 6d49ed716881d0007edc7cf092bd15f62a8c28ca1cfe23a522e9dba8d9deeef7
Instruction Fuzzy Hash: DF7173B15043409FD720DF64EC84EABB7E8FBC8754F049A0DF59997291D631DA08CBA2

Function 00E7F8B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7F8ED
wcsstr.MSVCR90 ref: 00E7F906
wcsncpy.MSVCR90 ref: 00E7F920
wcsncpy.MSVCR90 ref: 00E7F94A

Strings

@, xrefs: 00E7F926

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: wcsncpy$memsetwcsstr
String ID: @
API String ID: 825764456-2766056989
Opcode ID: 963d6af7e298da98d4a24dcf5a3b446f1db9bed14ff9a6bb8a1e2ffa3430b5ed
Instruction ID: f2a3accb267fb05a62a878374b14a2ed2ab35764b97b4f6827c537f34513b9c2
Opcode Fuzzy Hash: 963d6af7e298da98d4a24dcf5a3b446f1db9bed14ff9a6bb8a1e2ffa3430b5ed
Instruction Fuzzy Hash: 5A418671904345ABDB24DF64DC81AEB77E8EFC8300F00592EE94AA7240E775D5098B92

Function 00FDF150 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92filestringCOMMON

Download Yara Rule

APIs

lua_gettop.XLLUARUNTIME ref: 00FDF15E
lua_type.XLLUARUNTIME ref: 00FDF17D
lua_tonumber.XLLUARUNTIME ref: 00FDF190
fprintf.MSVCR90 ref: 00FDF1A1
_errno.MSVCR90 ref: 00FDF1B8
lua_pushboolean.XLLUARUNTIME(?,00000001), ref: 00FDF1C7
luaL_checklstring.XLLUARUNTIME(?,?,?), ref: 00FDF1E1
fwrite.MSVCR90 ref: 00FDF1F9
lua_pushnil.XLLUARUNTIME ref: 00FDF210
strerror.MSVCR90 ref: 00FDF216
lua_pushinteger.XLLUARUNTIME(?,?,?,00FF21AC,00000000), ref: 00FDF22A

Strings

%.14g, xrefs: 00FDF19B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_checklstring_errnofprintffwritelua_gettoplua_pushbooleanlua_pushintegerlua_pushnillua_tonumberlua_typestrerror
String ID: %.14g
API String ID: 2522848508-3267037135
Opcode ID: 1efab1bc8495cbe12ea4e50c09f1bc50392f56076e9403b6e0f37c0c5974a0e3
Instruction ID: 76a270396ad158c4ecd4694d15bf52486b10c941b62256146f8de2f5411d91e9
Opcode Fuzzy Hash: 1efab1bc8495cbe12ea4e50c09f1bc50392f56076e9403b6e0f37c0c5974a0e3
Instruction Fuzzy Hash: B121FB72C00204EBE2106724DC86F7B736EDF51B25F8C052BFD0697352E6659D54B6A2

Function 00FCF480 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

lua_isuserdata.XLLUARUNTIME(?,00000001), ref: 00FCF48E
lua_tointeger.XLLUARUNTIME(?,00000001), ref: 00FCF4A4
lua_isuserdata.XLLUARUNTIME(?,00000002), ref: 00FCF4B8
lua_tointeger.XLLUARUNTIME(?,00000002), ref: 00FCF4CE
lua_newuserdata.XLLUARUNTIME(?,00000008), ref: 00FCF4DE
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,_LOADED,00000000,?,?,?), ref: 00FCF509
lua_getfield.XLLUARUNTIME(?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,00000000,?,?,?), ref: 00FCF516
lua_setmetatable.XLLUARUNTIME(?,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,00000000,?,?,?), ref: 00FCF51E
lua_settop.XLLUARUNTIME(?,000000FE,?,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,00000000,?,?,?), ref: 00FCF526

Part of subcall function 00FCF1C0: lua_touserdata.XLLUARUNTIME(?,?,?,?,?,00FCFE3F,?,?), ref: 00FCF1CD
Part of subcall function 00FCF1C0: lua_getmetatable.XLLUARUNTIME(?,?), ref: 00FCF1DD
Part of subcall function 00FCF1C0: lua_getfield.XLLUARUNTIME(?,FFFFD8F0,_LOADED), ref: 00FCF1F4
Part of subcall function 00FCF1C0: lua_getfield.XLLUARUNTIME(?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED), ref: 00FCF201
Part of subcall function 00FCF1C0: lua_rawequal.XLLUARUNTIME(?,000000FF,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED), ref: 00FCF20B
Part of subcall function 00FCF1C0: lua_settop.XLLUARUNTIME(?,000000FC), ref: 00FCF21A

Strings

Xunlei.LuaRuntime.Int64, xrefs: 00FCF50E
_LOADED, xrefs: 00FCF4F9

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfield$lua_isuserdatalua_settoplua_tointeger$lua_getmetatablelua_newuserdatalua_rawequallua_setmetatablelua_touserdata
String ID: Xunlei.LuaRuntime.Int64$_LOADED
API String ID: 2764434586-3892714049
Opcode ID: 4c8aac07075a2655cae7c17883f27ac8e22e12ce01181265828b0e6971b3b5fd
Instruction ID: f4898dc4f4cad73074e3574bbd96e4fb2a54e7533d39d9a80b5b759c1969768c
Opcode Fuzzy Hash: 4c8aac07075a2655cae7c17883f27ac8e22e12ce01181265828b0e6971b3b5fd
Instruction Fuzzy Hash: B31159719457127AD604B7249C03F9F758E4F56B62F680137F904A23C2E99DA50862F7

Function 00FDE5D0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

luaL_checkany.XLLUARUNTIME(?,00000001), ref: 00FDE5D9

Part of subcall function 00FD70A0: lua_type.XLLUARUNTIME(?,?), ref: 00FD70AC
Part of subcall function 00FD70A0: luaL_argerror.XLLUARUNTIME(?,?,value expected), ref: 00FD70C0

lua_touserdata.XLLUARUNTIME(?,00000001,?,00000001), ref: 00FDE5E1
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,FILE*,?,00000001,?,00000001), ref: 00FDE5F3
lua_getmetatable.XLLUARUNTIME(?,00000001), ref: 00FDE602
lua_rawequal.XLLUARUNTIME(?,000000FE,000000FF), ref: 00FDE613
lua_pushlstring.XLLUARUNTIME(?,closed file,0000000B), ref: 00FDE62C
lua_pushlstring.XLLUARUNTIME(?,file,00000004), ref: 00FDE644
lua_pushnil.XLLUARUNTIME(?), ref: 00FDE655

Strings

FILE*, xrefs: 00FDE5E6
file, xrefs: 00FDE63E
closed file, xrefs: 00FDE626

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_pushlstring$L_argerrorL_checkanylua_getfieldlua_getmetatablelua_pushnillua_rawequallua_touserdatalua_type
String ID: FILE*$closed file$file
API String ID: 629077095-1636238272
Opcode ID: d84a2a5dd7cfae07c8041835a1e40dba4f2d9867259e67b7822220af5cffa196
Instruction ID: 53d931f807cbfc8b4a7556ca19d9e90f012f7dcb3228b043f61ee31f009e6afe
Opcode Fuzzy Hash: d84a2a5dd7cfae07c8041835a1e40dba4f2d9867259e67b7822220af5cffa196
Instruction Fuzzy Hash: 40016772A6562531D921311CBC03FDF724B4F62B36F5C0123F900693D6E6D9D58670AB

Function 00EC7B00 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 242stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(00000000,width,?,?,00000000,61C1F77A), ref: 00EC7B98
strncmp.MSVCR90(00000000,height,?), ref: 00EC7C00
strncmp.MSVCR90(00000000,right,?), ref: 00EC7C68

Part of subcall function 00EC91B0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EC91D9

strncmp.MSVCR90(00000000,bottom,?), ref: 00EC7CD0
strncmp.MSVCR90(00000000,left,?), ref: 00EC7D38

Part of subcall function 00EC95F0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EC9619

strncmp.MSVCR90(00000000,top,?), ref: 00EC7D9D

Part of subcall function 00EC99B0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EC99D9

Strings

top, xrefs: 00EC7D94
height, xrefs: 00EC7BF7
left, xrefs: 00EC7D2F
bottom, xrefs: 00EC7CC7
right, xrefs: 00EC7C5F
width, xrefs: 00EC7B8F

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: ProcessorVirtualstrncmp$Concurrency::RootRoot::
String ID: bottom$height$left$right$top$width
API String ID: 3925363580-3615874499
Opcode ID: ad73999adf71e00208d0799401638cabdeb396e51207aca044a2c2a2b09749a9
Instruction ID: 2e9b9f19f02f22e34caa89f54d92dd0dadf1d1496bc84d1c8846bef96befab19
Opcode Fuzzy Hash: ad73999adf71e00208d0799401638cabdeb396e51207aca044a2c2a2b09749a9
Instruction Fuzzy Hash: 36A1E0B0D0520ADFDB04CFE8DA45BEEBBB5AB48304F20522DE516BB281D7355A06CF51

Function 00E4FEF0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00E4FF0D
CreateDIBSection.GDI32 ref: 00E4FF75
SelectObject.GDI32(00000000,00000000), ref: 00E4FF84
SetRect.USER32(?,00000000,00000000,?,?), ref: 00E4FF93
SetRect.USER32(?,?,?), ref: 00E4FFB6
XL_PaintBitmap.MSVCR90(00000000,?,00000000,00000000), ref: 00E4FFCC
AlphaBlend.MSIMG32(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 00E4FFFD
DeleteDC.GDI32(00000000), ref: 00E50004
DeleteObject.GDI32(?), ref: 00E50012

Strings

(, xrefs: 00E4FF4C

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: CreateDeleteObjectRect$AlphaBitmapBlendCompatiblePaintSectionSelect
String ID: (
API String ID: 2359953928-3887548279
Opcode ID: 5f6604f4084ed5b151bfb41ac520aaa19b6b64f0668b0bd937ec606375f22958
Instruction ID: 6fecd3c979e8cbd42d67055d7b0ac9aa294f901fb032a459ec5149feae754424
Opcode Fuzzy Hash: 5f6604f4084ed5b151bfb41ac520aaa19b6b64f0668b0bd937ec606375f22958
Instruction Fuzzy Hash: 7131C9B1519344AFD320DF66D848EABBBECFBC9700F00491EF68593210DA71A909CB66

Function 00FDF0A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

lua_touserdata.XLLUARUNTIME(?,FFFFD8ED), ref: 00FDF0AD
luaL_error.XLLUARUNTIME(?,file is already closed), ref: 00FDF0C1

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

ferror.MSVCR90 ref: 00FDF0D3
_errno.MSVCR90 ref: 00FDF0E0
strerror.MSVCR90 ref: 00FDF0E9
luaL_error.XLLUARUNTIME(?,00FF21AC,00000000), ref: 00FDF0F6
lua_toboolean.XLLUARUNTIME(?,FFFFD8EC), ref: 00FDF115
lua_settop.XLLUARUNTIME(?,00000000), ref: 00FDF124
lua_pushvalue.XLLUARUNTIME(?,FFFFD8ED,?,00000000), ref: 00FDF12F

Strings

file is already closed, xrefs: 00FDF0BB

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_error$L_where_errnoferrorlua_concatlua_errorlua_pushvaluelua_pushvfstringlua_settoplua_tobooleanlua_touserdatastrerror
String ID: file is already closed
API String ID: 2835130823-1126627374
Opcode ID: 094294454bab07173e7850678707b5897ccccda7c6aa38391f3af547f9a74cb0
Instruction ID: d05a463cbe945ace1729fd4012c8ba43c40e5646ea49adedf2cac35b01f812ff
Opcode Fuzzy Hash: 094294454bab07173e7850678707b5897ccccda7c6aa38391f3af547f9a74cb0
Instruction Fuzzy Hash: 43014766A0152067DA0037A8BC42FAF365E9F82327F4C0033FA04D3353F6199519B1FA

Function 00FDF430 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lua_rawgeti.XLLUARUNTIME(?,FFFFD8EF,00000002), ref: 00FDF43F
lua_touserdata.XLLUARUNTIME(?,000000FF,?,FFFFD8EF,00000002), ref: 00FDF447
luaL_error.XLLUARUNTIME(?,standard %s file is closed,00FF2870), ref: 00FDF461

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

fflush.MSVCR90 ref: 00FDF46A
_errno.MSVCR90 ref: 00FDF47A
lua_pushboolean.XLLUARUNTIME(?,00000001), ref: 00FDF489
lua_pushnil.XLLUARUNTIME(?), ref: 00FDF49B
strerror.MSVCR90 ref: 00FDF4A1
lua_pushinteger.XLLUARUNTIME(?,?,?,00FF21AC,00000000,?,?), ref: 00FDF4B5

Strings

standard %s file is closed, xrefs: 00FDF45B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_errorL_where_errnofflushlua_concatlua_errorlua_pushbooleanlua_pushintegerlua_pushnillua_pushvfstringlua_rawgetilua_touserdatastrerror
String ID: standard %s file is closed
API String ID: 3796235457-758085179
Opcode ID: 9a04fbf1c87291432b16b8e980d7569a0042a270d9fd049563eaa18b6907b676
Instruction ID: f621cb16dfd4ec8125a96004bd87a030d23a9bae6dcc009e4fd4fe25918cf039
Opcode Fuzzy Hash: 9a04fbf1c87291432b16b8e980d7569a0042a270d9fd049563eaa18b6907b676
Instruction Fuzzy Hash: 0F01F77290052477D6127718AC82F7F332D9F82F26F4C0226FA11AB393D7595911B2F2

Function 00FDF4D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 54stringCOMMON

Download Yara Rule

APIs

luaL_checkudata.XLLUARUNTIME(?,00000001,FILE*), ref: 00FDF4DF

Part of subcall function 00FD6FC0: lua_touserdata.XLLUARUNTIME(?,?), ref: 00FD6FCE
Part of subcall function 00FD6FC0: lua_getmetatable.XLLUARUNTIME(?,?), ref: 00FD6FE2
Part of subcall function 00FD6FC0: lua_getfield.XLLUARUNTIME(?,FFFFD8F0,?), ref: 00FD6FF5
Part of subcall function 00FD6FC0: lua_rawequal.XLLUARUNTIME(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 00FD6FFF
Part of subcall function 00FD6FC0: lua_settop.XLLUARUNTIME(?,000000FD), ref: 00FD700E

luaL_error.XLLUARUNTIME(?,attempt to use a closed file), ref: 00FDF4F4

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

fflush.MSVCR90 ref: 00FDF4FF
_errno.MSVCR90 ref: 00FDF50F
lua_pushboolean.XLLUARUNTIME(?,00000001), ref: 00FDF51E
lua_pushnil.XLLUARUNTIME(?), ref: 00FDF530
strerror.MSVCR90 ref: 00FDF536
lua_pushinteger.XLLUARUNTIME(?,?,?,00FF21AC,00000000,?,?), ref: 00FDF54A

Strings

FILE*, xrefs: 00FDF4D7
attempt to use a closed file, xrefs: 00FDF4EE

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_checkudataL_errorL_where_errnofflushlua_concatlua_errorlua_getfieldlua_getmetatablelua_pushbooleanlua_pushintegerlua_pushnillua_pushvfstringlua_rawequallua_settoplua_touserdatastrerror
String ID: FILE*$attempt to use a closed file
API String ID: 618006575-999929173
Opcode ID: d875a7b98b82345a7a354ec837ecabe60ca9f92209df5d8d36b59e81e0ff393c
Instruction ID: 9259dee30e3f8c21cfd473add34141c0099f85dc013c4bcc5950bae0aad5694d
Opcode Fuzzy Hash: d875a7b98b82345a7a354ec837ecabe60ca9f92209df5d8d36b59e81e0ff393c
Instruction Fuzzy Hash: 2C01D672900114A7D6213B14BC82F7F376D9F81F26F4C012AFA05A7352D79D5956B2E3

Function 00E52A90 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90 ref: 00E52B4C
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52B94
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(00ED3484), ref: 00E52B9F
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52BFC
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52C65
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(00ED3484), ref: 00E52C70
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52CCD
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52D2C
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(00ED3484), ref: 00E52D37
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52D90
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52DDF

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: W@std@@$?assign@?$char_traits@_$?length@?$char_traits@_
String ID:
API String ID: 2115636358-0
Opcode ID: 58a2b36c29415b9dd48cc9d04ae3d5cbf3443e2613cd8f2eb14e5abd5e6b053c
Instruction ID: 2f5151570a324e9769cbad0ef8b3781fb3d3cca609bd8618d3dcd8d974bff652
Opcode Fuzzy Hash: 58a2b36c29415b9dd48cc9d04ae3d5cbf3443e2613cd8f2eb14e5abd5e6b053c
Instruction Fuzzy Hash: 66B143B14093419FC310DF64D981A6BFBE4FB89705F445D2EFA96A6212D734EA0CCB62

Function 00FE81A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

luaL_checklstring.XLLUARUNTIME(?,?,?), ref: 00FE81AA

Part of subcall function 00FD70D0: lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
Part of subcall function 00FD70D0: lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
Part of subcall function 00FD70D0: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

luaL_prepbuffer.XLLUARUNTIME ref: 00FE81FF
luaL_prepbuffer.XLLUARUNTIME ref: 00FE8213
luaL_addlstring.XLLUARUNTIME(?,00FF3BA4,00000002), ref: 00FE822B

Part of subcall function 00FD68D0: lua_pushlstring.XLLUARUNTIME(?,?), ref: 00FD6901

luaL_prepbuffer.XLLUARUNTIME ref: 00FE81BF

Part of subcall function 00FD6890: lua_pushlstring.XLLUARUNTIME(?,?), ref: 00FD68A8

luaL_prepbuffer.XLLUARUNTIME ref: 00FE8273

Strings

\000, xrefs: 00FE8237

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_prepbuffer$lua_pushlstringlua_typename$L_addlstringL_argerrorL_checklstringlua_tolstringlua_type
String ID: \000
API String ID: 4179832134-2104200393
Opcode ID: a4393a9834cd8d314b87ca5a827874bc64b59f3e9ce325b90b87e2c540e33e3c
Instruction ID: 4677485903eccd61a0420031ea4ebe235804aef2536d26ba9b0f93381785b48c
Opcode Fuzzy Hash: a4393a9834cd8d314b87ca5a827874bc64b59f3e9ce325b90b87e2c540e33e3c
Instruction Fuzzy Hash: 2921D1B44046C1DFE7116F10EC42A66BBB5AF66381F28086EE6C947203E7395546FBA3

Function 00FD0090 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

lua_isuserdata.XLLUARUNTIME(?,00000001), ref: 00FD0098
lua_isuserdata.XLLUARUNTIME(?,00000002), ref: 00FD00A7
lua_isnumber.XLLUARUNTIME(?,00000002), ref: 00FD00C1

Part of subcall function 00FCF8F0: lua_pushboolean.XLLUARUNTIME(?,00000001), ref: 00FCF91F

lua_isnumber.XLLUARUNTIME(?,00000001), ref: 00FD00E8
lua_isuserdata.XLLUARUNTIME(?,00000002), ref: 00FD00F7

Strings

invalid arg! int64 or number expect!, xrefs: 00FD00DC, 00FD012C

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_isuserdata$lua_isnumber$lua_pushboolean
String ID: invalid arg! int64 or number expect!
API String ID: 3364236900-3299302025
Opcode ID: fcb3adccb02f4a600ab12cda679dba742c539afefa90e5f0ce81ccae137b1754
Instruction ID: 4379f7d1acbadf25a7286ff6aa24b5dd2a59c1dc4cdb99a1ea68845773032908
Opcode Fuzzy Hash: fcb3adccb02f4a600ab12cda679dba742c539afefa90e5f0ce81ccae137b1754
Instruction Fuzzy Hash: 8211C066E51A2132ED2131243D07FDB350B0F11B56F8C4026F904683D7FACAAA9660F7

Function 00FCF1C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

lua_touserdata.XLLUARUNTIME(?,?,?,?,?,00FCFE3F,?,?), ref: 00FCF1CD
lua_getmetatable.XLLUARUNTIME(?,?), ref: 00FCF1DD
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,_LOADED), ref: 00FCF1F4
lua_getfield.XLLUARUNTIME(?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED), ref: 00FCF201
lua_rawequal.XLLUARUNTIME(?,000000FF,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED), ref: 00FCF20B
lua_settop.XLLUARUNTIME(?,000000FC), ref: 00FCF21A
luaL_typerror.XLLUARUNTIME(?,?,Xunlei.LuaRuntime.Int64), ref: 00FCF232

Strings

Xunlei.LuaRuntime.Int64, xrefs: 00FCF1F9, 00FCF22B
_LOADED, xrefs: 00FCF1E9

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfield$L_typerrorlua_getmetatablelua_rawequallua_settoplua_touserdata
String ID: Xunlei.LuaRuntime.Int64$_LOADED
API String ID: 4014528307-3892714049
Opcode ID: 1116ce403570bb55ad646ed7617c1b5d65a94d74b981005c27a9af5c1ec13d54
Instruction ID: 488578c716eb932685a26027bb69fea8f5d94d18eeeb9a555b6ade23f86d4e63
Opcode Fuzzy Hash: 1116ce403570bb55ad646ed7617c1b5d65a94d74b981005c27a9af5c1ec13d54
Instruction Fuzzy Hash: F6F07DBA60693636450071186C42EAF735EAC817727284332F434E23C1EB2DEA1571F7

Function 00FE2070 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

luaL_checklstring.XLLUARUNTIME(?,00000001,00000000), ref: 00FE207B

Part of subcall function 00FD70D0: lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
Part of subcall function 00FD70D0: lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
Part of subcall function 00FD70D0: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
Part of subcall function 00FD70D0: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

lua_getfield.XLLUARUNTIME(?,FFFFD8EF,preload,?,00000001,00000000), ref: 00FE208D
lua_type.XLLUARUNTIME(?,000000FF,?,FFFFD8EF,preload,?,00000001,00000000), ref: 00FE2095
luaL_error.XLLUARUNTIME(?,'package.preload' must be a table), ref: 00FE20A8

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

lua_getfield.XLLUARUNTIME(?,000000FF,00000000), ref: 00FE20B4
lua_type.XLLUARUNTIME(?,000000FF,?,000000FF,00000000), ref: 00FE20BC

Strings

'package.preload' must be a table, xrefs: 00FE20A2
no field package.preload['%s'], xrefs: 00FE20C9
preload, xrefs: 00FE2080

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_type$lua_getfieldlua_typename$L_argerrorL_checklstringL_errorL_wherelua_concatlua_errorlua_pushvfstringlua_tolstring
String ID: no field package.preload['%s']$'package.preload' must be a table$preload
API String ID: 3745296055-726884196
Opcode ID: 9a13f816231404b0882d12a626f15391651b067ad7cc1a56a6bcd7ae14b6e7f7
Instruction ID: d2c985829c977722a83b6d6ed3896e4edf03d3ec268cd066ceceb27508532b37
Opcode Fuzzy Hash: 9a13f816231404b0882d12a626f15391651b067ad7cc1a56a6bcd7ae14b6e7f7
Instruction Fuzzy Hash: 02F08271909A2031D53131292C03FAF355E4F92B35F580313F620713E6F998A64161AB

Function 00FD3050 Relevance: 15.1, APIs: 10, Instructions: 104COMMON

Download Yara Rule

APIs

lua_newuserdata.XLLUARUNTIME(?,?), ref: 00FD305C
lua_gettop.XLLUARUNTIME(?), ref: 00FD308E
lua_getfield.XLLUARUNTIME ref: 00FD30A7
lua_type.XLLUARUNTIME(?,000000FF), ref: 00FD30AF
lua_settop.XLLUARUNTIME(?,?), ref: 00FD3110
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,?,?,?), ref: 00FD311C
lua_setmetatable.XLLUARUNTIME(?,000000FE,?,FFFFD8F0,?,?,?), ref: 00FD3124

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfield$lua_gettoplua_newuserdatalua_setmetatablelua_settoplua_type
String ID:
API String ID: 760869682-0
Opcode ID: ee58fd7f397db3aa41014af2fb964dcb3ba1c7dcb8f9e4d93bf4b771f220ca76
Instruction ID: dc883f03e0c5a65b2ed8262efb6abfd91f8cdf79bd274dad06a68135988abfb1
Opcode Fuzzy Hash: ee58fd7f397db3aa41014af2fb964dcb3ba1c7dcb8f9e4d93bf4b771f220ca76
Instruction Fuzzy Hash: 5721F8729095152AD601B6286C06F6F729F4FD2338F1C061BF41053393EA296E42A2F7

Function 00FE7180 Relevance: 15.1, APIs: 10, Instructions: 82COMMON

Download Yara Rule

APIs

tolower.MSVCR90 ref: 00FE7185
isalpha.MSVCR90 ref: 00FE71AF
iscntrl.MSVCR90 ref: 00FE71BD
isdigit.MSVCR90 ref: 00FE71CB
ispunct.MSVCR90 ref: 00FE71E3
isspace.MSVCR90 ref: 00FE71F1
isupper.MSVCR90 ref: 00FE71FF
isalnum.MSVCR90 ref: 00FE720D
isxdigit.MSVCR90 ref: 00FE721B
islower.MSVCR90 ref: 00FE7232

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: isalnumisalphaiscntrlisdigitislowerispunctisspaceisupperisxdigittolower
String ID:
API String ID: 1429737575-0
Opcode ID: 5bf50a466e00c5ee288c4c5989c1f3cc4cda627dba157c195ffd600d9bec2360
Instruction ID: 6faf93b570c9d09a99ec61e5f5d908baae3cbad09bd56d8c683aa19d57280d99
Opcode Fuzzy Hash: 5bf50a466e00c5ee288c4c5989c1f3cc4cda627dba157c195ffd600d9bec2360
Instruction Fuzzy Hash: 66110AB38099B6EBDB10777D7C494AF35486D012A430D01B0F907F6214F6258D25FAE7

Function 00E54E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00E54FD2
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z.MSVCP90(?,?), ref: 00E54FF2
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z.MSVCP90(00000001,0000002E), ref: 00E55023
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ.MSVCP90(?,?,?,00000001), ref: 00E5504E
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ.MSVCP90(00000000), ref: 00E55059
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP90 ref: 00E55077

Strings

..., xrefs: 00E550A0

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$?append@?$basic_string@_V12@$??0?$basic_string@_??1?$basic_string@_?c_str@?$basic_string@_?size@?$basic_string@_
String ID: ...
API String ID: 2097304461-440645147
Opcode ID: b8603eac14f84c9e9ebc249c38771e2e4429cc7efff2f9a462b8f2372927525e
Instruction ID: 8dbb08a7c9adda4d04300db07000806bdad2af24e5c660a31fb7c147d6a82df1
Opcode Fuzzy Hash: b8603eac14f84c9e9ebc249c38771e2e4429cc7efff2f9a462b8f2372927525e
Instruction Fuzzy Hash: 167137B55087019FC314CF29D880A6ABBF5FFD8315F105A1EF995932A0DB70D988CB62

Function 00E7C380 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7C3A3

Part of subcall function 00E7C2B0: memset.MSVCR90 ref: 00E7C2D8
Part of subcall function 00E7C2B0: SystemParametersInfoW.USER32 ref: 00E7C2F3
Part of subcall function 00E7C2B0: wcsncpy.MSVCR90 ref: 00E7C31E

_wcsicmp.MSVCR90 ref: 00E7C3C4
_wcsicmp.MSVCR90 ref: 00E7C3D7
_wcsicmp.MSVCR90 ref: 00E7C3EA

Part of subcall function 00E7C1F0: memset.MSVCR90 ref: 00E7C21C
Part of subcall function 00E7C1F0: wcsncpy.MSVCR90 ref: 00E7C23C
Part of subcall function 00E7C1F0: GetDC.USER32(00000000), ref: 00E7C247
Part of subcall function 00E7C1F0: EnumFontFamiliesExW.GDI32 ref: 00E7C27F
Part of subcall function 00E7C1F0: ReleaseDC.USER32(00000000,00000000), ref: 00E7C288

wcsncpy.MSVCR90 ref: 00E7C45B

Strings

Microsoft YaHei, xrefs: 00E7C3D1, 00E7C41C
SimSun, xrefs: 00E7C3BE, 00E7C3FF
Microsoft YaHei UI, xrefs: 00E7C3E4, 00E7C439

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _wcsicmpmemsetwcsncpy$EnumFamiliesFontInfoParametersReleaseSystem
String ID: Microsoft YaHei$Microsoft YaHei UI$SimSun
API String ID: 380406342-1986890003
Opcode ID: ee6897c0125be561b7969137a03f4a5706c4453f9409a2e0a7aeca25f9567d04
Instruction ID: 9095ebd29a88bea0ef01c63eb3b2e3efe76643af30a6f739be86fcc045537319
Opcode Fuzzy Hash: ee6897c0125be561b7969137a03f4a5706c4453f9409a2e0a7aeca25f9567d04
Instruction Fuzzy Hash: D721A4B5A003007AD610DB649C92FBB73EDDFC4744F50991EF558B6282F6B1D60986A3

Function 00FE2490 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

luaL_checktype.XLLUARUNTIME(?,00000001,00000005), ref: 00FE249A

Part of subcall function 00FD7050: lua_type.XLLUARUNTIME(?,?), ref: 00FD705C
Part of subcall function 00FD7050: lua_typename.XLLUARUNTIME(?,?), ref: 00FD706F
Part of subcall function 00FD7050: lua_type.XLLUARUNTIME(?,?,?,?), ref: 00FD7078
Part of subcall function 00FD7050: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,?), ref: 00FD707F
Part of subcall function 00FD7050: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,?), ref: 00FD7094

lua_getmetatable.XLLUARUNTIME(?,00000001,?,00000001,00000005), ref: 00FE24A2
lua_createtable.XLLUARUNTIME(?,00000000,00000001), ref: 00FE24B2
lua_pushvalue.XLLUARUNTIME(?,000000FF,?,00000000,00000001), ref: 00FE24BA
lua_setmetatable.XLLUARUNTIME(?,00000001,?,000000FF,?,00000000,00000001), ref: 00FE24C2
lua_pushvalue.XLLUARUNTIME(?,FFFFD8EE), ref: 00FE24D0
lua_setfield.XLLUARUNTIME(?,000000FE,__index,?,FFFFD8EE), ref: 00FE24DD

Strings

__index, xrefs: 00FE24D5

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_pushvaluelua_typelua_typename$L_argerrorL_checktypelua_createtablelua_getmetatablelua_setfieldlua_setmetatable
String ID: __index
API String ID: 3333155683-4084755486
Opcode ID: 29021efa779cf4af7dc2e706a27a6c7c4199578672d558fbc86c8d85c489e4d3
Instruction ID: 57f424ed419b123a735cdac8e80da714c65a72d6bc71eaa2bcfe4b4453b6b7b8
Opcode Fuzzy Hash: 29021efa779cf4af7dc2e706a27a6c7c4199578672d558fbc86c8d85c489e4d3
Instruction Fuzzy Hash: 69E0E561A5AE3431E81272381C43FDF304B1F52B26F9D0252F615B52D3FA8E568624FA

Function 00FCC1C0 Relevance: 13.7, APIs: 9, Instructions: 151COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E3DC3B0A), ref: 00FCC1F5
?compare@?$char_traits@D@std@@SAHPBD0I@Z.MSVCP90(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,00FD2B8A), ref: 00FCC24D
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF,00FD2B8A,?), ref: 00FCC27E
lua_pushnil.XLLUARUNTIME(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF,00FD2B8A,?), ref: 00FCC2A3
lua_setfield.XLLUARUNTIME(00000000,FFFFD8EE,?,00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00FCC2AF
lua_pushnil.XLLUARUNTIME(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF,00FD2B8A,?), ref: 00FCC2CC
lua_setfield.XLLUARUNTIME(00000000,FFFFD8EE,?,00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00FCC2DC
memmove_s.MSVCR90 ref: 00FCC338
LeaveCriticalSection.KERNEL32(?), ref: 00FCC350

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: CriticalSection$Leavelua_pushnillua_setfield$?compare@?$char_traits@D@std@@Entermemmove_s
String ID:
API String ID: 1931814450-0
Opcode ID: 098288f328b911da4922b2f65c1bb6335942d7f137c3e908de5f95080b2e0313
Instruction ID: 454c7eb6bb77a87c14e4b528b59103a2848374e5a52fb21a73ac3550f685c91b
Opcode Fuzzy Hash: 098288f328b911da4922b2f65c1bb6335942d7f137c3e908de5f95080b2e0313
Instruction Fuzzy Hash: C651EF729046029BDB20DF68DE82B6AB7E8FB45710F08091CE859D7301E735EC05EBE2

Function 00FE0130 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 247COMMON

Download Yara Rule

APIs

iscntrl.MSVCR90 ref: 00FE029E

Strings

nesting of [[...]] is deprecated, xrefs: 00FE0284
%s near '%s', xrefs: 00FE0203, 00FE02CA
%s:%d: %s, xrefs: 00FE01ED, 00FE028F
unfinished long comment, xrefs: 00FE01C8
unfinished long string, xrefs: 00FE01C1, 00FE01E6
char(%d), xrefs: 00FE02AC

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: iscntrl
String ID: %s near '%s'$%s:%d: %s$char(%d)$nesting of [[...]] is deprecated$unfinished long comment$unfinished long string
API String ID: 23777793-1797284299
Opcode ID: 724600d2bf267b163d5c9cbb42a898d7cd6f3cf0e268ef195e72687783b161b4
Instruction ID: 8bdec089af51703b7b1855f4a57d7d537e28a3b12b98c289bd3d9332cd2c703d
Opcode Fuzzy Hash: 724600d2bf267b163d5c9cbb42a898d7cd6f3cf0e268ef195e72687783b161b4
Instruction Fuzzy Hash: 4D91E6B19002409FCB04EF55CCD1E2677A9AF85304F4885A9F9068F356DBB9EC85EB92

Function 00EB17A0 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 340stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,eexec,00000005), ref: 00EB183A
strncmp.MSVCR90(?,closefile,00000009), ref: 00EB18A4
strncmp.MSVCR90(?,FontDirectory,0000000D), ref: 00EB190E

Strings

eexec, xrefs: 00EB1834
8W, xrefs: 00EB1A3C, 00EB1A44
FontDirectory, xrefs: 00EB1908
CharStrings, xrefs: 00EB1AAD
closefile, xrefs: 00EB189E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp
String ID: 8W$CharStrings$FontDirectory$closefile$eexec
API String ID: 1114863663-795481199
Opcode ID: 07497bc5f6bd2c50482e4646209027bb8c18e6a9f596c23a1e8ad76687614844
Instruction ID: 9d842a5c4713507be0777dc67f102c319606d76e819c60481a90203af46dc918
Opcode Fuzzy Hash: 07497bc5f6bd2c50482e4646209027bb8c18e6a9f596c23a1e8ad76687614844
Instruction Fuzzy Hash: 8EB1F63424524A4BCB388A1C94747F7B792BB96368FD864DEE8C5B7214E320EC87C646

Function 00FD8070 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

lua_gettop.XLLUARUNTIME(?), ref: 00FD8077
lua_type.XLLUARUNTIME(?,00000001,?), ref: 00FD8081
lua_tolstring.XLLUARUNTIME(?,00000001,00000000), ref: 00FD8093
lua_pushinteger.XLLUARUNTIME(?,00000000), ref: 00FD80A3
luaL_checkinteger.XLLUARUNTIME(?,00000001), ref: 00FD80B7
luaL_argerror.XLLUARUNTIME(?,00000001,index out of range), ref: 00FD80DC

Strings

index out of range, xrefs: 00FD80D4

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_checkintegerlua_gettoplua_pushintegerlua_tolstringlua_type
String ID: index out of range
API String ID: 443603861-2815927717
Opcode ID: a79632594b5fd1de562d5edb1118f38439d7d3f13e22ef9cfc7162b150e5751c
Instruction ID: 1cfcdaae1b184968b04b188c0209bc094fd16f7d5c1766c5934df360cce77281
Opcode Fuzzy Hash: a79632594b5fd1de562d5edb1118f38439d7d3f13e22ef9cfc7162b150e5751c
Instruction Fuzzy Hash: F2F0A976E5051026DA3135546CC6B7E624B8BA1FA6F1D0137FE04A7382D5CB5D863193

Function 00FD7190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

lua_tonumber.XLLUARUNTIME(?,?), ref: 00FD719F
lua_isnumber.XLLUARUNTIME(?,?), ref: 00FD71BA
lua_typename.XLLUARUNTIME(?,00000003), ref: 00FD71CA
lua_type.XLLUARUNTIME(?,?,?,00000003), ref: 00FD71D3
lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000003), ref: 00FD71DA
luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000003), ref: 00FD71EF

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

Strings

%s expected, got %s, xrefs: 00FD71E1

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_typename$L_argerrorL_errorlua_getstacklua_isnumberlua_tonumberlua_type
String ID: %s expected, got %s
API String ID: 2001163409-156976391
Opcode ID: 70eac9a213c6d5b45101ef93baf1ce20b7a34184b34414d6adad46da9c1ce374
Instruction ID: 4d24e87f817c01597f66471629eeac6fbdf730a4d2d3443f6a05085a6a89b8f4
Opcode Fuzzy Hash: 70eac9a213c6d5b45101ef93baf1ce20b7a34184b34414d6adad46da9c1ce374
Instruction Fuzzy Hash: 90F0F652801A5136950136209C07FEF366E9EC3B57F48001AF94461202E71C561961FB

Function 00FE7080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

luaL_checktype.XLLUARUNTIME(?,00000001,00000006), ref: 00FE70A1

Part of subcall function 00FD7050: lua_type.XLLUARUNTIME(?,?), ref: 00FD705C
Part of subcall function 00FD7050: lua_typename.XLLUARUNTIME(?,?), ref: 00FD706F
Part of subcall function 00FD7050: lua_type.XLLUARUNTIME(?,?,?,?), ref: 00FD7078
Part of subcall function 00FD7050: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,?), ref: 00FD707F
Part of subcall function 00FD7050: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,?), ref: 00FD7094

lua_settop.XLLUARUNTIME(?,00000001,?,00000001,00000006), ref: 00FE70A9
luaL_buffinit.XLLUARUNTIME(?,?,?,00000001,?,00000001,00000006), ref: 00FE70B4
lua_dump.XLLUARUNTIME(?,Function_00027060,?,?,?,?,00000001,?,00000001,00000006), ref: 00FE70C4
luaL_error.XLLUARUNTIME(?,unable to dump given function), ref: 00FE70D6

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

luaL_pushresult.XLLUARUNTIME(?), ref: 00FE70E3

Strings

unable to dump given function, xrefs: 00FE70D0

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_typelua_typename$L_argerrorL_buffinitL_checktypeL_errorL_pushresultL_wherelua_concatlua_dumplua_errorlua_pushvfstringlua_settop
String ID: unable to dump given function
API String ID: 739528140-4187293423
Opcode ID: 1ca259e960092c335f78579c5c469ecac29efbc4d02b20b26cda0727463c4038
Instruction ID: fe1465068690dcf7f06b328a23d67d0ac238446e79caaf807325fb5448c7618e
Opcode Fuzzy Hash: 1ca259e960092c335f78579c5c469ecac29efbc4d02b20b26cda0727463c4038
Instruction Fuzzy Hash: 90F0F67195431427E620FB24DC87FEF339A9F58700F484819F548A62C2EBBCA645A7E3

Function 00FCF170 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

lua_newuserdata.XLLUARUNTIME(?,00000008,00000000,00FCFEC2,00000000,000000FF,7FFFFFFF,00000000,Xunlei.LuaRuntime.Int64,00FF1960,?,?,00FD0161,?), ref: 00FCF178
lua_getfield.XLLUARUNTIME(?,FFFFD8F0,_LOADED,?,00000008,00000000,00FCFEC2,00000000,000000FF,7FFFFFFF,00000000,Xunlei.LuaRuntime.Int64,00FF1960,?,?,00FD0161), ref: 00FCF195
lua_getfield.XLLUARUNTIME(?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,?,00000008,00000000,00FCFEC2,00000000,000000FF,7FFFFFFF,00000000,Xunlei.LuaRuntime.Int64,00FF1960), ref: 00FCF1A2
lua_setmetatable.XLLUARUNTIME(?,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,?,00000008,00000000,00FCFEC2,00000000,000000FF,7FFFFFFF,00000000), ref: 00FCF1AA
lua_settop.XLLUARUNTIME(?,000000FE,?,000000FD,?,000000FF,Xunlei.LuaRuntime.Int64,?,FFFFD8F0,_LOADED,?,00000008,00000000,00FCFEC2,00000000,000000FF), ref: 00FCF1B2

Strings

Xunlei.LuaRuntime.Int64, xrefs: 00FCF19A
_LOADED, xrefs: 00FCF185

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_getfield$lua_newuserdatalua_setmetatablelua_settop
String ID: Xunlei.LuaRuntime.Int64$_LOADED
API String ID: 3093328914-3892714049
Opcode ID: 7c852f83da0f6bca2ee6dfd31ed4927790a56b2ed98609d15f0b34b074553dd8
Instruction ID: aeeb26b415d31a483abb5ec416c04db46a20a4ef21001b5630ea9a93d37d3298
Opcode Fuzzy Hash: 7c852f83da0f6bca2ee6dfd31ed4927790a56b2ed98609d15f0b34b074553dd8
Instruction Fuzzy Hash: 12E0927514EB25B68600AB149C02EAE36A65F46B31F144706F020373E1CA2CA50267EB

Function 00E527C0 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90 ref: 00E52830
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?,?,?,?,?,?,?,?,?,?), ref: 00E528BE
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(00ED3484,?,?,?,?,?,?,?,?,?,?,?), ref: 00E528C9
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52929
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E529A2
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(00ED3484), ref: 00E529AD
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52A09
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E52A5E

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: W@std@@$?assign@?$char_traits@_$?length@?$char_traits@_
String ID:
API String ID: 2115636358-0
Opcode ID: be369b2754b736357215771302414dbcf1e137129c5bb3785b1c26e57503ec5c
Instruction ID: 2cc506e19b83fdf1f58f7f777b5ee25bda1a6fb54cdfe678ddd4e8de31d8a2fd
Opcode Fuzzy Hash: be369b2754b736357215771302414dbcf1e137129c5bb3785b1c26e57503ec5c
Instruction Fuzzy Hash: 988135B14083418FC310DF65D880A6BBBF4FB89705F444A2EF6A9A7251D735EA09CB93

Function 00E8CA20 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 198COMMON

Download Yara Rule

APIs

sprintf.MSVCR90 ref: 00E8CAAC
sprintf.MSVCR90 ref: 00E8CB30

Strings

FONT_ASCENT, xrefs: 00E8CA64, 00E8CA73, 00E8CAB6
ENDPROPERTIES, xrefs: 00E8CA38
%hd, xrefs: 00E8CAA6, 00E8CB2A
FONT_DESCENT, xrefs: 00E8CAE8, 00E8CAF7, 00E8CB3A
COMMENT, xrefs: 00E8CB8E
_XFREE86_GLYPH_RANGES, xrefs: 00E8CB7C

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: sprintf
String ID: %hd$COMMENT$ENDPROPERTIES$FONT_ASCENT$FONT_DESCENT$_XFREE86_GLYPH_RANGES
API String ID: 590974362-1053162884
Opcode ID: 98235547a0c47647f9879f1d0c45907123c0208a1fd4c3abcfdf78d9beae4e28
Instruction ID: 8e43c1d050fbab33e5293ea3951be502340592f4307323560db95a120b608c00
Opcode Fuzzy Hash: 98235547a0c47647f9879f1d0c45907123c0208a1fd4c3abcfdf78d9beae4e28
Instruction Fuzzy Hash: 5961F1767007055BD320EB14C881E6BB3E4FB99704F18952AE88DAB741E775FC0687A1

Function 00FD7400 Relevance: 12.1, APIs: 8, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strstr.MSVCR90 ref: 00FD7463
luaL_addlstring.XLLUARUNTIME(?,?,00000000), ref: 00FD747D
luaL_addlstring.XLLUARUNTIME(?,?,?), ref: 00FD74A0
strstr.MSVCR90 ref: 00FD74AE
luaL_addlstring.XLLUARUNTIME(?,?,?), ref: 00FD74D2
lua_pushlstring.XLLUARUNTIME(?,?,?), ref: 00FD74F4
lua_concat.XLLUARUNTIME(?,?), ref: 00FD7512
lua_tolstring.XLLUARUNTIME(?,000000FF,00000000,?,?), ref: 00FD7524

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_addlstring$strstr$lua_concatlua_pushlstringlua_tolstring
String ID:
API String ID: 519468106-0
Opcode ID: 858356ca423c571805d509fa02606c4b31d7f79fed3650ca818a45538804bd0a
Instruction ID: 2f0e6919a1c0427311b3fffb138b0cebceec7fe65110704bc4960bdc9dbcc9c5
Opcode Fuzzy Hash: 858356ca423c571805d509fa02606c4b31d7f79fed3650ca818a45538804bd0a
Instruction Fuzzy Hash: 0041A4719083559FC311DF18D844AABB7E9AFC9714F084A5DF88897311D774EA08DBE2

Function 00E7ED40 Relevance: 12.1, APIs: 8, Instructions: 111COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7ED92
wcsstr.MSVCR90 ref: 00E7EDA7
wcsncpy.MSVCR90 ref: 00E7EDBF
wcsncpy.MSVCR90 ref: 00E7EDE7

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: wcsncpy$memsetwcsstr
String ID:
API String ID: 825764456-0
Opcode ID: cc8295bd92835fe7fcc6367a3295abcad6e8e7b736bfa102165062763f4a9281
Instruction ID: 24012a174e3271fd9466bf99709605b9f4750fe5d501e3daa7b2744aba849698
Opcode Fuzzy Hash: cc8295bd92835fe7fcc6367a3295abcad6e8e7b736bfa102165062763f4a9281
Instruction Fuzzy Hash: F831E3726043046BD724DB34DC81AEFB7E4EFC8314F05891EE54DA7250EA34A609C793

Function 00E7FE40 Relevance: 12.1, APIs: 8, Instructions: 109COMMON

Download Yara Rule

APIs

CreateFontW.GDI32(0000000C,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000007,00000000,00000000,00000000,?), ref: 00E7FE6D

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: CreateFont
String ID:
API String ID: 1830492434-0
Opcode ID: e7cb836408a79e8f454cb32bce1734024e4d4491a7b981968772ed504f97aa1a
Instruction ID: 6dee1d97a464277bf7d17ea0ef963da8589a19b45257b4dbb4a3c4ad03ac065c
Opcode Fuzzy Hash: e7cb836408a79e8f454cb32bce1734024e4d4491a7b981968772ed504f97aa1a
Instruction Fuzzy Hash: 7D31D6752843007EE320CB349C42F7BB7E89B92F14F10961DF655BA1D2DAB0F846866A

Function 00EB0C00 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 326stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,StandardEncoding,00000010), ref: 00EB0C69

Strings

.notdef, xrefs: 00EB0DC2
ISOLatin1Encoding, xrefs: 00EB0CBF
ExpertEncoding, xrefs: 00EB0C91
StandardEncoding, xrefs: 00EB0C63

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp
String ID: .notdef$ExpertEncoding$ISOLatin1Encoding$StandardEncoding
API String ID: 1114863663-1497679585
Opcode ID: daa9d41a768aeddccab73a74914009021be89f29953c017c26b5249fbe2e76fd
Instruction ID: 44eb061023b6d8015bc9b4d02c9866e3e9db2fe103c63a4acb28632fb76a94cf
Opcode Fuzzy Hash: daa9d41a768aeddccab73a74914009021be89f29953c017c26b5249fbe2e76fd
Instruction Fuzzy Hash: 9DB1B2703043058FD730CF18D884BFBB7E5EF88318F545A6AE989A6241D335F94A8B96

Function 00EA2F80 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 300stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,StandardEncoding,00000010), ref: 00EA2FE9

Strings

.notdef, xrefs: 00EA3142
ISOLatin1Encoding, xrefs: 00EA303F
ExpertEncoding, xrefs: 00EA3011
StandardEncoding, xrefs: 00EA2FE3

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp
String ID: .notdef$ExpertEncoding$ISOLatin1Encoding$StandardEncoding
API String ID: 1114863663-1497679585
Opcode ID: c38f0a0146fab17fe850abce6e2be2cdc90bd1bcde5ee8123a6c8f96effac1a6
Instruction ID: 67682e4e24627e2780c61ac4259ddab87fd557a31453b4887f45c9569feb6324
Opcode Fuzzy Hash: c38f0a0146fab17fe850abce6e2be2cdc90bd1bcde5ee8123a6c8f96effac1a6
Instruction Fuzzy Hash: BDA129706043019FD720CF28D884BAAF7E5FF89318F54496EF9899B201E375FA198B91

Function 00EA3A30 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,FontDirectory,0000000D), ref: 00EA3A7F
strncmp.MSVCR90(?,known,00000005), ref: 00EA3AB7

Strings

8W, xrefs: 00EA3B4D
FontDirectory, xrefs: 00EA3A79
known, xrefs: 00EA3AB1
/, xrefs: 00EA3B10
F, xrefs: 00EA3A62

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp
String ID: /$8W$F$FontDirectory$known
API String ID: 1114863663-2944846225
Opcode ID: 4f64edb0ff0803e0ea2a46f8401f9571a7de8168c7bf3dfaffd9372013ddeee9
Instruction ID: df5ad67a7216ce82e573e0f6b4b445ed99e396e7116b558832b35439252575c2
Opcode Fuzzy Hash: 4f64edb0ff0803e0ea2a46f8401f9571a7de8168c7bf3dfaffd9372013ddeee9
Instruction Fuzzy Hash: FE51C8706042049BCF209F34D8C566ABB96EF5E314F196499FC4BAF206E331FE148B62

Function 00E804E0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E804E6
SelectObject.GDI32(00000000,?), ref: 00E804F4
GetOutlineTextMetricsW.GDI32(00000000,00000000,00000000,?,00E80645,00000000,00000058), ref: 00E80507
memset.MSVCR90 ref: 00E80527
GetOutlineTextMetricsW.GDI32(00000000,00000000,00000000,?,?,?,?), ref: 00E80538
SelectObject.GDI32(00000000,?), ref: 00E80578
ReleaseDC.USER32(00000000,00000000), ref: 00E80581

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: MetricsObjectOutlineSelectText$Releasememset
String ID:
API String ID: 3503544693-0
Opcode ID: b59b6fabfdbc940b094f51441a4de0caef5d3bb615335dcb5a3d066fb94fad51
Instruction ID: 58c535533057b277cddf7bcc94ec6f2fb1b0b6c9e4e731b4eebcde477d44dbf9
Opcode Fuzzy Hash: b59b6fabfdbc940b094f51441a4de0caef5d3bb615335dcb5a3d066fb94fad51
Instruction Fuzzy Hash: 9C214C75902600AFD324DF65EC48F17BBE8EB89710F05811EF949A7361D770E9098BB2

Function 00FD70D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

lua_tolstring.XLLUARUNTIME(?,?,?), ref: 00FD70E2
lua_typename.XLLUARUNTIME(?,00000004), ref: 00FD70F4
lua_type.XLLUARUNTIME(?,?,?,00000004), ref: 00FD70FD
lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000004), ref: 00FD7104
luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000004), ref: 00FD7119

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

Strings

%s expected, got %s, xrefs: 00FD710B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_typename$L_argerrorL_errorlua_getstacklua_tolstringlua_type
String ID: %s expected, got %s
API String ID: 3803413682-156976391
Opcode ID: ade03d553e2f0ae5c256f0c87b28fe7ac1ed04c8f4f957c3a446d7a5ae1e984d
Instruction ID: ace3100483148929a41b26436f342c5c37aea8d03cfc1d985a0b06f894205633
Opcode Fuzzy Hash: ade03d553e2f0ae5c256f0c87b28fe7ac1ed04c8f4f957c3a446d7a5ae1e984d
Instruction Fuzzy Hash: A6F06CA16066543BD10176959C42EBF739DCEC7B2AF480027FE00E2302D65DAD0552FA

Function 00FD85B0 Relevance: 10.5, APIs: 7, Instructions: 38COMMON

Download Yara Rule

APIs

lua_tothread.XLLUARUNTIME(?,FFFFD8ED), ref: 00FD85BC
lua_gettop.XLLUARUNTIME(?,?,FFFFD8ED), ref: 00FD85C4

Part of subcall function 00FD8470: lua_checkstack.XLLUARUNTIME ref: 00FD8481
Part of subcall function 00FD8470: luaL_error.XLLUARUNTIME(?,too many arguments to resume), ref: 00FD8493

lua_isstring.XLLUARUNTIME(?,000000FF), ref: 00FD85DC
luaL_where.XLLUARUNTIME(?,00000001), ref: 00FD85EB

Part of subcall function 00FD6520: lua_getstack.XLLUARUNTIME(?,?,?,?), ref: 00FD653E
Part of subcall function 00FD6520: lua_getinfo.XLLUARUNTIME(?,00FF1C64,?,?,?,?), ref: 00FD6555

lua_insert.XLLUARUNTIME(?,000000FE,?,00000001), ref: 00FD85F3
lua_concat.XLLUARUNTIME(?,00000002,?,000000FE,?,00000001), ref: 00FD85FB
lua_error.XLLUARUNTIME(?), ref: 00FD8604

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_errorL_wherelua_checkstacklua_concatlua_errorlua_getinfolua_getstacklua_gettoplua_insertlua_isstringlua_tothread
String ID:
API String ID: 1096481142-0
Opcode ID: a7afeb3cc668cc822a2e873ac8bf6adb43a25581fdc7b86292aecd30b1918039
Instruction ID: 6cae3f45fb495163758ac482dec9dec692af92b2482fdb219986a30d7d7d6b76
Opcode Fuzzy Hash: a7afeb3cc668cc822a2e873ac8bf6adb43a25581fdc7b86292aecd30b1918039
Instruction Fuzzy Hash: BAF01256A0452122C91232242C42F2F715B0BD2FB6B5D032AF814A63D3ED5D990271EA

Function 00FD7050 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

lua_type.XLLUARUNTIME(?,?), ref: 00FD705C
lua_typename.XLLUARUNTIME(?,?), ref: 00FD706F
lua_type.XLLUARUNTIME(?,?,?,?), ref: 00FD7078
lua_typename.XLLUARUNTIME(?,00000000,?,?,?,?), ref: 00FD707F
luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,?), ref: 00FD7094

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

Strings

%s expected, got %s, xrefs: 00FD7086

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_typelua_typename$L_argerrorL_errorlua_getstack
String ID: %s expected, got %s
API String ID: 2725611123-156976391
Opcode ID: 89f55e1efb0f292d072b86e56e214db0344439c4e9db54ff5013a45c13a5e54d
Instruction ID: 48e11da923dbc28445524a5c9b634f2052a3c27508771381bc2584a9a1c3d497
Opcode Fuzzy Hash: 89f55e1efb0f292d072b86e56e214db0344439c4e9db54ff5013a45c13a5e54d
Instruction Fuzzy Hash: EFE092A1506A613A551173649C46CBF736EDDC6B16B4C041BF500E2302D6586D0A61FA

Function 00FD8140 Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

luaL_checkany.XLLUARUNTIME(?,00000002), ref: 00FD8148

Part of subcall function 00FD70A0: lua_type.XLLUARUNTIME(?,?), ref: 00FD70AC
Part of subcall function 00FD70A0: luaL_argerror.XLLUARUNTIME(?,?,value expected), ref: 00FD70C0

lua_settop.XLLUARUNTIME(?,00000002,?,00000002), ref: 00FD8150
lua_insert.XLLUARUNTIME(?,00000001,?,00000002,?,00000002), ref: 00FD8158
lua_pcall.XLLUARUNTIME(?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 00FD8164
lua_pushboolean.XLLUARUNTIME(?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 00FD8172
lua_replace.XLLUARUNTIME(?,00000001,?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 00FD817A
lua_gettop.XLLUARUNTIME(?,?,00000001,?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 00FD8180

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_checkanylua_gettoplua_insertlua_pcalllua_pushbooleanlua_replacelua_settoplua_type
String ID:
API String ID: 3357644997-0
Opcode ID: 2d50b3d31366ea16ac47d3bb0e4e97ac318be82e6b395634163105fc41e944a4
Instruction ID: 95f31d3fd02f0f0ebf258798ecfdbd23fee4f50342dde7477efca504e5c25a92
Opcode Fuzzy Hash: 2d50b3d31366ea16ac47d3bb0e4e97ac318be82e6b395634163105fc41e944a4
Instruction Fuzzy Hash: E2E0B675257E2231E92232245C5BFCF210A0F03F22F9C8107B6107A2D2EACD264221EF

Function 00FDA1C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

lua_type.XLLUARUNTIME(?,00000002), ref: 00FDA1C8
luaL_argerror.XLLUARUNTIME(?,00000002,nil or table expected), ref: 00FDA1E1

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

lua_settop.XLLUARUNTIME(?,00000002), ref: 00FDA1EC
lua_setmetatable.XLLUARUNTIME(?,00000001,?,00000002), ref: 00FDA1F4
lua_pushboolean.XLLUARUNTIME(?,00000000,?,00000001,?,00000002), ref: 00FDA1FB

Strings

nil or table expected, xrefs: 00FDA1D9

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_errorlua_getstacklua_pushbooleanlua_setmetatablelua_settoplua_type
String ID: nil or table expected
API String ID: 3702188742-2873205112
Opcode ID: 69a2f6b9cc95338aa7e5c748d61547c95cebd6efdd9f7d6e1fe27d88532bc9f3
Instruction ID: ad78a52d99179c90124dff25f93081d87efce8a2bfb15727c81d163c99b34bb0
Opcode Fuzzy Hash: 69a2f6b9cc95338aa7e5c748d61547c95cebd6efdd9f7d6e1fe27d88532bc9f3
Instruction Fuzzy Hash: 25E0EC6AE41A2032E52132146C47FDE320B4F02B16FCC4057FA04B63C3EA8E9B4265EF

Function 00E68060 Relevance: 9.3, APIs: 6, Instructions: 278COMMON

Download Yara Rule

APIs

_CIsin.MSVCR90 ref: 00E68087
_CIcos.MSVCR90 ref: 00E68094
_CIsin.MSVCR90 ref: 00E68125
_CIcos.MSVCR90 ref: 00E68132
_CIsin.MSVCR90 ref: 00E68166
_CIcos.MSVCR90 ref: 00E68173

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: IcosIsin
String ID:
API String ID: 14690888-0
Opcode ID: 57b35d67ccefffeff2ca3460dd4490ecf96a56d458fcfa3ae231c8eb7c069730
Instruction ID: c8e48e30b158213f3523a23d3cd5c7869da912fa9bfa6823bc22dbff7d9418f9
Opcode Fuzzy Hash: 57b35d67ccefffeff2ca3460dd4490ecf96a56d458fcfa3ae231c8eb7c069730
Instruction Fuzzy Hash: FCB14FB2E04B05A7C3567E40E155186BBB4FB857D0F621E88D4C5A127AFF3289788BC6

Function 00E7A200 Relevance: 9.2, APIs: 6, Instructions: 242COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,?,?), ref: 00E7A222
OffsetRect.USER32(?,?,?), ref: 00E7A2B6
OffsetRect.USER32(?,?,?), ref: 00E7A31B

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Rect$Offset$Intersect
String ID:
API String ID: 407234963-0
Opcode ID: 1476b6c292d88ba2ee969437cf0047d73e39eb59321b92dddea5be4ed45b9c57
Instruction ID: 2d0d0d9b6fe358787829e7d369613ad62a607d74dbb412f3cd74d5c3d33781a3
Opcode Fuzzy Hash: 1476b6c292d88ba2ee969437cf0047d73e39eb59321b92dddea5be4ed45b9c57
Instruction Fuzzy Hash: 71A16EB56087019FC304CF99D98086BFBE9EFC8704F548A2EF59993314E771EA058B96

Function 00FD65E0 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

lua_getfield.XLLUARUNTIME(00000000,FFFFD8F0,?,?,00000000,00FC3332,00000000,?,00000000,00000000,00000000,00FD2F36,?,?,00000000,00000000), ref: 00FD65F1
lua_type.XLLUARUNTIME(00000000,000000FF,00000000,FFFFD8F0,?,?,00000000,00FC3332,00000000,?,00000000,00000000,00000000,00FD2F36,?,?), ref: 00FD65F9
lua_settop.XLLUARUNTIME(00000000,000000FE,?,?,00000000,00000000), ref: 00FD660D
lua_createtable.XLLUARUNTIME(00000000,00000000,00000000,00000000,000000FE,?,?,00000000,00000000), ref: 00FD6617
lua_pushvalue.XLLUARUNTIME(00000000,000000FF,00000000,00000000,00000000,00000000,000000FE,?,?,00000000,00000000), ref: 00FD661F
lua_setfield.XLLUARUNTIME(00000000,FFFFD8F0,?,00000000,000000FF,00000000,00000000,00000000,00000000,000000FE,?,?,00000000,00000000), ref: 00FD662B

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_createtablelua_getfieldlua_pushvaluelua_setfieldlua_settoplua_type
String ID:
API String ID: 891371016-0
Opcode ID: e9aa32e51c29dd1baaa8f54fdf8f989d4b2586e382c5c63226e2c4f16e0bd076
Instruction ID: 9807e3a7dc6bcf67d6942b8bf35009c486b764c6dc15bcea0ea32f22ec2c79a1
Opcode Fuzzy Hash: e9aa32e51c29dd1baaa8f54fdf8f989d4b2586e382c5c63226e2c4f16e0bd076
Instruction Fuzzy Hash: 97E0393250DA3235DA11712D6C02F8F725E5F83B32FA80327F420A63D29A48A58261EE

Function 00FD80F0 Relevance: 9.0, APIs: 6, Instructions: 29COMMON

Download Yara Rule

APIs

luaL_checkany.XLLUARUNTIME(?,00000001), ref: 00FD80F8

Part of subcall function 00FD70A0: lua_type.XLLUARUNTIME(?,?), ref: 00FD70AC
Part of subcall function 00FD70A0: luaL_argerror.XLLUARUNTIME(?,?,value expected), ref: 00FD70C0

lua_gettop.XLLUARUNTIME(?,000000FF,00000000), ref: 00FD8105
lua_pcall.XLLUARUNTIME(?,-00000001,00000000), ref: 00FD8110
lua_pushboolean.XLLUARUNTIME(?,00000000,?,-00000001,00000000), ref: 00FD811E
lua_insert.XLLUARUNTIME(?,00000001,?,00000000,?,-00000001,00000000), ref: 00FD8126
lua_gettop.XLLUARUNTIME(?,?,00000001,?,00000000,?,-00000001,00000000), ref: 00FD812C

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_gettop$L_argerrorL_checkanylua_insertlua_pcalllua_pushbooleanlua_type
String ID:
API String ID: 1826909310-0
Opcode ID: 0a7dae82f6358bf8d689852638305d09878078cec31e0550d8a5adc2b2b93a71
Instruction ID: f13fd1f5fb8af92b7db76c29bcc7e0769037b97c9ff90d1071fcb8fb53025e45
Opcode Fuzzy Hash: 0a7dae82f6358bf8d689852638305d09878078cec31e0550d8a5adc2b2b93a71
Instruction Fuzzy Hash: 11E08CA6917E2231E50132302C57FDF300E8F12B22F8C4113F811653C2FA8D6B9210EB

Function 00E7FBE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7FC3D
_DebugHeapAllocator.LIBCPMTD ref: 00E7FC4A
_itow.MSVCR90 ref: 00E7FC7A

Part of subcall function 00ECFF90: GetPrivateProfileStringW.KERNEL32(?,00E7F4EE,?,?,00000000,00000000), ref: 00ECFFB4

_itow.MSVCR90 ref: 00E7FCC8

Strings

FontRenderSetting, xrefs: 00E7FC80, 00E7FCCE

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _itow$AllocatorDebugHeapPrivateProfileStringmemset
String ID: FontRenderSetting
API String ID: 2101332600-3994362974
Opcode ID: c500a685d15b6a1ba51918108fa253b8795a13522b339b056d708004c9894b76
Instruction ID: 00fafe4d313793b4fc395f4a32cc4076e4875befb7c4856c2ebcaefd80af9452
Opcode Fuzzy Hash: c500a685d15b6a1ba51918108fa253b8795a13522b339b056d708004c9894b76
Instruction Fuzzy Hash: 2731A572214341AFC324DB14CD51FABB3E8EFC8714F445A2DF849A7281D771AA09C792

Function 00E7F450 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00E7F4AA
_itow.MSVCR90 ref: 00E7F4DA

Part of subcall function 00ECFF90: GetPrivateProfileStringW.KERNEL32(?,00E7F4EE,?,?,00000000,00000000), ref: 00ECFFB4

_itow.MSVCR90 ref: 00E7F528

Strings

CharFontSetting, xrefs: 00E7F4E0, 00E7F52E
1, SIMSUN, 1, 12, Tahoma, xrefs: 00E7F491

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _itow$AllocatorDebugHeapPrivateProfileString
String ID: 1, SIMSUN, 1, 12, Tahoma$CharFontSetting
API String ID: 629645009-281330025
Opcode ID: 66bbcea53cfcfeff961976e08ffc2a71abd9a7a1ae8413aa78be4d1a5cdae600
Instruction ID: 0b0fcf4b38a1bbcea05bb89cc5e4b34e04b0db93b4523e53a180bb6bc8c6a333
Opcode Fuzzy Hash: 66bbcea53cfcfeff961976e08ffc2a71abd9a7a1ae8413aa78be4d1a5cdae600
Instruction Fuzzy Hash: BF31C731214340ABC324DB24CD52FABB3E8EF88714F44562DF449A72D1E774AA05C792

Function 00EC8750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

codecvt.LIBCPMTD ref: 00EC877C
codecvt.LIBCPMTD ref: 00EC87B0
codecvt.LIBCPMTD ref: 00EC87E4
codecvt.LIBCPMTD ref: 00EC8818

Strings

Bh, xrefs: 00EC876B

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: codecvt
String ID: Bh
API String ID: 3662085145-1857079555
Opcode ID: 08a4eb4988e7eeaf51d0881886b103a8a84e9ed7bee3f8ccad0bc6ca7ffb044c
Instruction ID: 8cae3e5792642dea4ed58ae42f5383527052be96a63d2469147e69a8ba1bf0fc
Opcode Fuzzy Hash: 08a4eb4988e7eeaf51d0881886b103a8a84e9ed7bee3f8ccad0bc6ca7ffb044c
Instruction Fuzzy Hash: 81314E74D00209DBDB08DF95D785BEEBBB1AB48304F205569D4117B291DB76AE82CFA0

Function 00E66080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

XL_CreateExp.MSVCR90(?,?,00E66109,?,?), ref: 00E6608C

Part of subcall function 00EC6480: Concurrency::details::_Condition_variable::_Condition_variable.LIBCMTD ref: 00EC649C

XL_SetExp.MSVCR90(00000000,a,?,?,?,00E66109,?,?), ref: 00E6609E

Part of subcall function 00EC6530: Concurrency::details::_Condition_variable::_Condition_variable.LIBCMTD ref: 00EC653F
Part of subcall function 00EC6530: _Immortalize.LIBCPMTD ref: 00EC6561

XL_GetExpValue.MSVCR90(00000000,00000000,a,?,?), ref: 00E660AF
XL_DeleteExp.MSVCR90(00000000,00000000,a,?,?,?,00E66109,?,?), ref: 00E660B7

Strings

a, xrefs: 00E66091, 00E6609C

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Concurrency::details::_Condition_variableCondition_variable::_$CreateDeleteImmortalizeValue
String ID: a
API String ID: 3843554737-1016852433
Opcode ID: db0a54b2ef4be2c3309d4772b1a9ed8ef3bb55870fbbd1e92e3b8156cf768581
Instruction ID: a28b9d38162fe1b5906e23ded75d534b7c59348fe34fd73be81f5ee5922c2f68
Opcode Fuzzy Hash: db0a54b2ef4be2c3309d4772b1a9ed8ef3bb55870fbbd1e92e3b8156cf768581
Instruction Fuzzy Hash: C4E06D311153115BD714AF25B900BABB3D8BF80365F04182EF850E2241E771884686E2

Function 00FE3440 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

luaL_optlstring.XLLUARUNTIME(?,00000001,00000000,00000000), ref: 00FE344D

Part of subcall function 00FD7130: lua_type.XLLUARUNTIME(?,?), ref: 00FD713C

luaL_checkoption.XLLUARUNTIME(?,00000002,all,00FF3590,?,00000001,00000000,00000000), ref: 00FE3461

Part of subcall function 00FD7550: lua_type.XLLUARUNTIME(?,?), ref: 00FD7566
Part of subcall function 00FD7550: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,invalid option '%s',00000000), ref: 00FD75E5

setlocale.MSVCR90 ref: 00FE346F
lua_pushstring.XLLUARUNTIME(?,00000000), ref: 00FE3477

Strings

all, xrefs: 00FE3457

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_type$L_argerrorL_checkoptionL_optlstringlua_pushstringsetlocale
String ID: all
API String ID: 2374952761-991457757
Opcode ID: a71b175d0ee6404481904ae7ef212038f4a9360b0ab0a8f8f2440d00fd6d9e7b
Instruction ID: d6dd6c8e44d9d7c9eaff39ce13173a238304f4b1ef259170b1a11c015830be46
Opcode Fuzzy Hash: a71b175d0ee6404481904ae7ef212038f4a9360b0ab0a8f8f2440d00fd6d9e7b
Instruction Fuzzy Hash: DFE0CD31A5132972E62076A8BC0BFDB769D4FC5B00F0C0402B204EF2E1E5D8FA8192E9

Function 00FDE590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 21stringCOMMON

Download Yara Rule

APIs

_errno.MSVCR90 ref: 00FDE590
strerror.MSVCR90 ref: 00FDE599
lua_tolstring.XLLUARUNTIME(?,000000FF,00000000,?,%s: %s,?,00000000), ref: 00FDE5B5
luaL_argerror.XLLUARUNTIME(?,?,00000000,?,000000FF,00000000,?,%s: %s,?,00000000), ref: 00FDE5C1

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

Strings

%s: %s, xrefs: 00FDE5A5

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_error_errnolua_getstacklua_tolstringstrerror
String ID: %s: %s
API String ID: 2937447132-3740598653
Opcode ID: 34988afc908f6b762a84abbed09be6aae1c3c1ab2bd680ead03956eb3c4cb2b1
Instruction ID: 310a4616dfd4b53b2d23c853d58bd0d221fb4501433994c2351f4d19f717efac
Opcode Fuzzy Hash: 34988afc908f6b762a84abbed09be6aae1c3c1ab2bd680ead03956eb3c4cb2b1
Instruction Fuzzy Hash: D3E01274104510BFD101AB60DC46F7F335EAF89719F944204F62496391DA68A901A76A

Function 00E6E0F0 Relevance: 7.8, APIs: 5, Instructions: 266windowCOMMON

Download Yara Rule

APIs

XL_CloneBitmap.MSVCR90(?,61C1F77A,?,00000000,?,?,?,00ED19F6,000000FF,00E6E457,?,?,?,61C1F77A,?,?), ref: 00E6E20D
XL_StretchBitmap.MSVCR90(00000000,?,?,61C1F77A,?,00000000,?,?,?,00ED19F6,000000FF,00E6E457,?,?,?,61C1F77A), ref: 00E6E21B
XL_ReleaseBitmap.MSVCR90(?,00000000,?,?,?,00ED19F6,000000FF,00E6E457,?,?,?,61C1F77A,?,?), ref: 00E6E239
XL_SetTextureRect.MSVCR90 ref: 00E6E2F1
XL_DefaultGraphicHint.MSVCR90(?), ref: 00E6E37F

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Bitmap$CloneDefaultGraphicHintRectReleaseStretchTexture
String ID:
API String ID: 733161657-0
Opcode ID: b24d076021148fd306441f258d110b167920432f930fa58a7470e9a878f1b00c
Instruction ID: beeb3f5306776d62f786fb29886cb54aa4984efc001208ddeb2d75e0d8f44849
Opcode Fuzzy Hash: b24d076021148fd306441f258d110b167920432f930fa58a7470e9a878f1b00c
Instruction Fuzzy Hash: 7BA19FB5A447409FC720CF19E480A2BF7E5FBC8754F144A2EE48A93741E736E905CB92

Function 00E55380 Relevance: 7.7, APIs: 5, Instructions: 239COMMON

Download Yara Rule

APIs

Part of subcall function 00E53AD0: IntersectRect.USER32(?,?,?), ref: 00E53B05

memset.MSVCR90 ref: 00E5551A
XL_FillBlend.MSVCR90 ref: 00E5556B
XL_SetPenColor.MSVCR90(?,?), ref: 00E555F6
XL_DrawLine.MSVCR90(?,?,?,?,?,?,?), ref: 00E5562A
XL_DrawLine.MSVCR90(?,?,?,?,?,?,?), ref: 00E55658

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: DrawLine$BlendColorFillIntersectRectmemset
String ID:
API String ID: 4191478769-0
Opcode ID: 107d87d636174377aa52825a211b82867c60d525a175fef503ee3b636a63165b
Instruction ID: 75489bb97ad7c0329976bc4ccba6f009b48fefa31cda53cbfede1a2f86a7a4be
Opcode Fuzzy Hash: 107d87d636174377aa52825a211b82867c60d525a175fef503ee3b636a63165b
Instruction Fuzzy Hash: B29148B55087809FC324DF64C591B6BBBE5BFC8314F14895DE9899B342DB30E849CBA2

Function 00E7E2B0 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90 ref: 00E7E34E
?length@?$char_traits@_W@std@@SAIPB_W@Z.MSVCP90(?), ref: 00E7E355
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?,?,00000000,75A8EB20,000001FC,00000000), ref: 00E7E388
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E7E3D7
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z.MSVCP90(?,?), ref: 00E7E422

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: W@std@@$?assign@?$char_traits@_$?length@?$char_traits@_
String ID:
API String ID: 2115636358-0
Opcode ID: 9fbfe950fbb58d3b21057ec63250c0bf081860965f44e9f5dc7199526d89bc9a
Instruction ID: 5a0ce3a125e006697fedba3d8b1dc9318f5f1ad270ef88c4f14b39463dc5c235
Opcode Fuzzy Hash: 9fbfe950fbb58d3b21057ec63250c0bf081860965f44e9f5dc7199526d89bc9a
Instruction Fuzzy Hash: 26416FB28083009FC310DF59D985A5BFBF8FB88754F445A2EF59AA3251D735E908CB92

Function 00E65E40 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

_itoa.MSVCR90 ref: 00E65E93
XL_SetRectExpLeft.MSVCR90(?,?,00000000,00ED3524,00ED3524,00ED3524,?,?,?,?,?), ref: 00E65EB4
XL_SetRectExpTop.MSVCR90(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00E65ECF
XL_SetRectExpWidth.MSVCR90(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E65EEA
XL_SetRectExpHeight.MSVCR90(?,00000000), ref: 00E65F05

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Rect$HeightLeftWidth_itoa
String ID:
API String ID: 457614765-0
Opcode ID: ebc180578b15c92273f9600caa6ef41225fc4fdf72312f081246e387abcac776
Instruction ID: 24dd9caa68540e7b66948cfb8d96d8dd70ce8737a0bfc42c64b9104c0d3b49c5
Opcode Fuzzy Hash: ebc180578b15c92273f9600caa6ef41225fc4fdf72312f081246e387abcac776
Instruction Fuzzy Hash: 2721A672704A009FC618EB39E89297BF3E8EF88350FC5980EF45BD7641DA35E9148792

Function 00E89FA0 Relevance: 7.6, APIs: 5, Instructions: 65fileCOMMON

Download Yara Rule

APIs

fopen.MSVCR90 ref: 00E89FD0

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: fopen
String ID:
API String ID: 1432627528-0
Opcode ID: 0476487820cd5e18e92fa2135d73cbf1d4cdc9e4ffc8941c695df87242a1ef3f
Instruction ID: 4f6c947f3a01fdd603c106c9381963c497b7fdac71e8b3356978d06a448085b0
Opcode Fuzzy Hash: 0476487820cd5e18e92fa2135d73cbf1d4cdc9e4ffc8941c695df87242a1ef3f
Instruction Fuzzy Hash: D011A3716017085FD320AF6EFC8496BBBECEB84725B44442FF14ED6601C775A5498BA2

Function 00E7C1F0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E7C21C
wcsncpy.MSVCR90 ref: 00E7C23C
GetDC.USER32(00000000), ref: 00E7C247
EnumFontFamiliesExW.GDI32 ref: 00E7C27F
ReleaseDC.USER32(00000000,00000000), ref: 00E7C288

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: EnumFamiliesFontReleasememsetwcsncpy
String ID:
API String ID: 2212730583-0
Opcode ID: 3deac4909b0893b217d0ad06ce7fe4b6c206fd28d7f3f7e504c1e0a8fce3527b
Instruction ID: f318c41199ac126ac6784d700cf03523900ffcba111fa28e2ac948834031396a
Opcode Fuzzy Hash: 3deac4909b0893b217d0ad06ce7fe4b6c206fd28d7f3f7e504c1e0a8fce3527b
Instruction Fuzzy Hash: 061119715093809FD350DF699805B9BBBE4BFC8704F44890EF69897291D77096088BA3

Function 00E4FCC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

(, xrefs: 00E4FEA2
(, xrefs: 00E4FD82

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID: ($(
API String ID: 0-222463766
Opcode ID: a979cc26b72ab127e7f2401fe6c2ab1c3ea7b029d7ec2da63041a5af29a0852c
Instruction ID: 82563811b1c48c8ec0c66894b90acf2484b4d8d9900f9d92af6ec27b3bae31a7
Opcode Fuzzy Hash: a979cc26b72ab127e7f2401fe6c2ab1c3ea7b029d7ec2da63041a5af29a0852c
Instruction Fuzzy Hash: BA6136B16083419FC718CF69D480A1BBBE5EFC8714F108A2EF999D7355E771E8048B66

Function 00E79710 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E79739
_wcsicmp.MSVCR90 ref: 00E7974B
wcsncpy.MSVCR90 ref: 00E797A6

Strings

defaultfont, xrefs: 00E79745

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _wcsicmpmemsetwcsncpy
String ID: defaultfont
API String ID: 4002316500-3013108229
Opcode ID: 76984e0cc36ad5d50246318a288184a081f08cd34c6fbc59988fa0180f239479
Instruction ID: b7bcf74cd2f95b2df28728a48664b906b626571d0b0ae4e7bb409784b6ecf081
Opcode Fuzzy Hash: 76984e0cc36ad5d50246318a288184a081f08cd34c6fbc59988fa0180f239479
Instruction Fuzzy Hash: B721D371A002085BDB24BF799C85AAF77DCEFD1318F14942BF91AB7213EB75C9048662

Function 00ECDCA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(vector<T> too long,61C1F77A,?,?,?,?,?,?,00000000,00ED2639,000000FF,?,00ECD133,00000000,?,00ECCB6C), ref: 00ECDCCD
_CxxThrowException.MSVCR90(?,00EEAF50), ref: 00ECDCEF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP90(?,00EEAF50,?,?,?,?,?,?,?,00000000,00ED2639,000000FF,?,00ECD133,00000000), ref: 00ECDCFE

Strings

vector<T> too long, xrefs: 00ECDCC5

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrow
String ID: vector<T> too long
API String ID: 2034288732-3788999226
Opcode ID: 24843003db6b3eaee2156e7bf33acc2474b7c4c46cac47aaabcc2827f62af675
Instruction ID: 11bb3aae817eb4ec12bd195c8fd6ab5e2a608e36816b1a45b15bfddfb7a1c434
Opcode Fuzzy Hash: 24843003db6b3eaee2156e7bf33acc2474b7c4c46cac47aaabcc2827f62af675
Instruction Fuzzy Hash: CCF03171955748EFC704EFA1DD41B9DB7B8FB04720F50422AE412772D4DB746A09CA41

Function 00FDF010 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

lua_rawgeti.XLLUARUNTIME(?,FFFFD8EF,00000001), ref: 00FDF01E
lua_touserdata.XLLUARUNTIME(?,000000FF,?,FFFFD8EF,00000001), ref: 00FDF026
luaL_error.XLLUARUNTIME(?,standard %s file is closed,00FF2878), ref: 00FDF040

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

Strings

standard %s file is closed, xrefs: 00FDF03A

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_errorL_wherelua_concatlua_errorlua_pushvfstringlua_rawgetilua_touserdata
String ID: standard %s file is closed
API String ID: 707260198-758085179
Opcode ID: f9da067a46652d0dd79bc8e50a6bee110f9256d0574fe5f7a8550da06a2828d7
Instruction ID: 4b7de92c45eba9705adc537a23ed399b9ef7d2a90d9d131f2c4cf168476da088
Opcode Fuzzy Hash: f9da067a46652d0dd79bc8e50a6bee110f9256d0574fe5f7a8550da06a2828d7
Instruction Fuzzy Hash: D9E0263660042033C5027208BC02FAF335A4F82B30F1D0222F9146B3D3E659AA41B3E6

Function 00FD8420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

lua_tothread.XLLUARUNTIME(?,00000001), ref: 00FD8429
luaL_argerror.XLLUARUNTIME(?,00000001,coroutine expected), ref: 00FD843F

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

lua_pushstring.XLLUARUNTIME(?,00000000,?), ref: 00FD8456

Strings

coroutine expected, xrefs: 00FD8437

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_errorlua_getstacklua_pushstringlua_tothread
String ID: coroutine expected
API String ID: 1607481980-3001328647
Opcode ID: 4a4eabccecc58f8abd216e1f2fdeede1ebb18f8aeb8f3d8dfdb8761779a9b5ab
Instruction ID: 8aeb18114469e25ff211d3ab4ee100ed9490ec03cfdc4aee39e3fcad020c6736
Opcode Fuzzy Hash: 4a4eabccecc58f8abd216e1f2fdeede1ebb18f8aeb8f3d8dfdb8761779a9b5ab
Instruction Fuzzy Hash: 15E08C3294111427D62232587C82FBF776E4FD2F61F09001AF804AA392E6DE9883B1E2

Function 00FDF060 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

luaL_checkudata.XLLUARUNTIME(?,00000001,FILE*), ref: 00FDF06E

Part of subcall function 00FD6FC0: lua_touserdata.XLLUARUNTIME(?,?), ref: 00FD6FCE
Part of subcall function 00FD6FC0: lua_getmetatable.XLLUARUNTIME(?,?), ref: 00FD6FE2
Part of subcall function 00FD6FC0: lua_getfield.XLLUARUNTIME(?,FFFFD8F0,?), ref: 00FD6FF5
Part of subcall function 00FD6FC0: lua_rawequal.XLLUARUNTIME(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 00FD6FFF
Part of subcall function 00FD6FC0: lua_settop.XLLUARUNTIME(?,000000FD), ref: 00FD700E

luaL_error.XLLUARUNTIME(?,attempt to use a closed file), ref: 00FDF083

Part of subcall function 00FD65B0: luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8
Part of subcall function 00FD65B0: lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
Part of subcall function 00FD65B0: lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
Part of subcall function 00FD65B0: lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

Strings

FILE*, xrefs: 00FDF066
attempt to use a closed file, xrefs: 00FDF07D

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_checkudataL_errorL_wherelua_concatlua_errorlua_getfieldlua_getmetatablelua_pushvfstringlua_rawequallua_settoplua_touserdata
String ID: FILE*$attempt to use a closed file
API String ID: 3674837396-999929173
Opcode ID: 8662aae5c42d7bbfd17ebf2410282d7da5a9ab6e510d18c04dfd5ab43747d06a
Instruction ID: dfd867531b4d9de28c024e106a7787e5da650419ff803ae0fa4ce39433f8c9ab
Opcode Fuzzy Hash: 8662aae5c42d7bbfd17ebf2410282d7da5a9ab6e510d18c04dfd5ab43747d06a
Instruction Fuzzy Hash: 62D0C222A5021123C6203204BC03F9F77568F85724F0D0032F50867382F2E94596A2E3

Function 00E74900 Relevance: 6.4, APIs: 4, Instructions: 386COMMON

Download Yara Rule

APIs

XL_DefaultGraphicHint.MSVCR90(?,?,?), ref: 00E74A50
XL_DefaultGraphicHint.MSVCR90(?,00000000), ref: 00E74B16
XL_DefaultGraphicHint.MSVCR90(?,?), ref: 00E74CE0
XL_DefaultGraphicHint.MSVCR90(?,?), ref: 00E74D44

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: DefaultGraphicHint
String ID:
API String ID: 196006533-0
Opcode ID: 21db2183ba64deafa3f4872dffa13fceb8784d455ad3b0395909607f195573fc
Instruction ID: b157e0ca48f6517160456a2a304fdd0619976f0777fc3eee609156eafa59d63a
Opcode Fuzzy Hash: 21db2183ba64deafa3f4872dffa13fceb8784d455ad3b0395909607f195573fc
Instruction Fuzzy Hash: 77E112B4A087019FC728DF69D48092BF7E5AFC8700F14992EFA9997361E771E841CB52

Function 00E6F280 Relevance: 6.4, APIs: 4, Instructions: 377COMMON

Download Yara Rule

APIs

XL_DefaultGraphicHint.MSVCR90(?,?,?), ref: 00E6F3C6
XL_DefaultGraphicHint.MSVCR90(?,00000000), ref: 00E6F480
XL_DefaultGraphicHint.MSVCR90(?,?), ref: 00E6F643
XL_DefaultGraphicHint.MSVCR90(?,?), ref: 00E6F6A7

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: DefaultGraphicHint
String ID:
API String ID: 196006533-0
Opcode ID: fc0d40361d760c31d98f82e781ed8f3cd40712e36aee2b381394db46767819ac
Instruction ID: 3435faa7ceb989278ebbdcf8d0685b409336d558286eb7ab9facbca0ae638b5c
Opcode Fuzzy Hash: fc0d40361d760c31d98f82e781ed8f3cd40712e36aee2b381394db46767819ac
Instruction Fuzzy Hash: 3AE101B4A087018FC728DF69E48092BFBE5AFC8740F14992EF59997321E770E841CB52

Function 00E6E400 Relevance: 6.4, APIs: 4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4620180af047483895c7362a72bb131017a756e37f2c0adc7c5b681c2f348754
Instruction ID: 418814399446d4ebdcae0ffde502ba0716d413544ff223af5b15bbe66ba2c5a3
Opcode Fuzzy Hash: 4620180af047483895c7362a72bb131017a756e37f2c0adc7c5b681c2f348754
Instruction Fuzzy Hash: D9E10874A083459FCB24CF18D480AAEBBE5EF88754F149A1EF849A7395D770ED40CB92

Function 00E558A0 Relevance: 6.3, APIs: 4, Instructions: 278windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90(?,?), ref: 00E558B0
XL_GetLogPen.MSVCR90(?,?,?,?,?), ref: 00E5595E
XL_CreatePen.MSVCR90 ref: 00E5597C
XL_ReleasePen.MSVCR90(?), ref: 00E559FD

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapCreateInfoRelease
String ID:
API String ID: 3571685347-0
Opcode ID: 1638825227e32f4085998cb728ad4665b9a606f6cc73a0d85c1f62312fd34cc8
Instruction ID: af53847561ab93c12c4379bc0e4e4dc49954383dfb69ac50ea05890222ed77b4
Opcode Fuzzy Hash: 1638825227e32f4085998cb728ad4665b9a606f6cc73a0d85c1f62312fd34cc8
Instruction Fuzzy Hash: 15817E722086449FD318CEA9C894D2BF3E9EFC9354F144A1DF995D3340E675EC498B62

Function 00E55B60 Relevance: 6.3, APIs: 4, Instructions: 278windowCOMMON

Download Yara Rule

APIs

XL_GetBitmapInfo.MSVCR90(?,?), ref: 00E55B70
XL_GetLogPen.MSVCR90(?,?,?,?,?), ref: 00E55C1E
XL_CreatePen.MSVCR90 ref: 00E55C3C
XL_ReleasePen.MSVCR90(?), ref: 00E55CBD

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: BitmapCreateInfoRelease
String ID:
API String ID: 3571685347-0
Opcode ID: e7a18767a92ad06a60936c0686f5d9c3cf847af7c81f2e2da6305a3745431fd4
Instruction ID: 8645682ff153ba51947cbd4575dbc02dc338b14122118f2a919a9f09afe251a5
Opcode Fuzzy Hash: e7a18767a92ad06a60936c0686f5d9c3cf847af7c81f2e2da6305a3745431fd4
Instruction Fuzzy Hash: ED8159726087019FC318CEA9C99092BF7E9EFC9354F14491DF995D3340EAB5EC498BA2

Function 00EB0FB0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 219stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,dup,00000003), ref: 00EB1080
strncmp.MSVCR90(00000000,put,00000003), ref: 00EB10F7

Strings

dup, xrefs: 00EB107A
put, xrefs: 00EB10F1

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp
String ID: dup$put
API String ID: 1114863663-1042916250
Opcode ID: 230483c8870ca89991525dd29a0dd1a0a57201f846f86253ec048adda492b661
Instruction ID: a44f16dd1c612a2c8ef8bb88356c4d4b28948b7f3bc06e89e37ba5572d8feb30
Opcode Fuzzy Hash: 230483c8870ca89991525dd29a0dd1a0a57201f846f86253ec048adda492b661
Instruction Fuzzy Hash: F3717F716003019FCB04DF29C894A9BB7E8FF88315F4455A9FD4ADB216E634EA14CBA1

Function 00FCD4C0 Relevance: 6.2, APIs: 4, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E3DC3B0A), ref: 00FCD4F5
?compare@?$char_traits@D@std@@SAHPBD0I@Z.MSVCP90(?,?,?), ref: 00FCD58D
LeaveCriticalSection.KERNEL32(?,?,00000001,?), ref: 00FCD64D

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: CriticalSection$?compare@?$char_traits@D@std@@EnterLeave
String ID:
API String ID: 2356793199-0
Opcode ID: 731ddc1acf86d7e183a70cf037d2e1d263fcd534ed71793f6d5e0be98fd0be78
Instruction ID: 169b7767bbc29412d13f4b55d67f60bb76c3839dd30d809360d04527eed4d4b8
Opcode Fuzzy Hash: 731ddc1acf86d7e183a70cf037d2e1d263fcd534ed71793f6d5e0be98fd0be78
Instruction Fuzzy Hash: 0B51C571604202CFC714CF28DA85F2AB7E5FF88744F19492DE84ADB341DA31E905DB91

Function 00E65AE0 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bedb0a3e417928c47d422025335cb4f7a706abbbd757d671d6cfba09b15608
Instruction ID: 3293c548dd6ec30cba45c87578cd003d946db4da84b6206ca54cf3b41f7b146e
Opcode Fuzzy Hash: 11bedb0a3e417928c47d422025335cb4f7a706abbbd757d671d6cfba09b15608
Instruction Fuzzy Hash: 3B417EB26047009FC714DF69E98095BF7E9AFC8754F448A1DF988A3311E731E949CB92

Function 00E80A60 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetGlyphOutlineW.GDI32(?,?,?,00000020,?,?,0000000E), ref: 00E80ABF
GetGlyphOutlineW.GDI32(?,?,00000000,00000020,?,?,0000000E), ref: 00E80ADA

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: GlyphOutline
String ID:
API String ID: 2311061089-0
Opcode ID: a81f112313266073cb5be2c4873d2e15bc0d1a2cd1cba25db067b4163c1b11f8
Instruction ID: c3f5b758a2fc80436c365c1822a7daeada0426f29660ecdffca30cb19e8e29d0
Opcode Fuzzy Hash: a81f112313266073cb5be2c4873d2e15bc0d1a2cd1cba25db067b4163c1b11f8
Instruction Fuzzy Hash: 9C318D71200700AFD224DF26D884E67F7EDEF95764F108A0EF59A97690D361BC898B61

Function 00E510A0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

?_Xran@_String_base@std@@SAXXZ.MSVCP90 ref: 00E510B3
?_Xlen@_String_base@std@@SAXXZ.MSVCP90 ref: 00E510DC
?_Xlen@_String_base@std@@SAXXZ.MSVCP90 ref: 00E510F7
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z.MSVCP90(00000008,00000008,?,?), ref: 00E51159

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: String_base@std@@$Xlen@_$Copy_s@?$char_traits@_W@std@@Xran@_
String ID:
API String ID: 3651241351-0
Opcode ID: eacd90fc2afe834b928d80837e3b5c98450b0b578a4dbe3bd0e38fa0c755c558
Instruction ID: a9e3cd9f871423f83106cbe352695a1312f0e5babe130e121115bd0ec69dfab7
Opcode Fuzzy Hash: eacd90fc2afe834b928d80837e3b5c98450b0b578a4dbe3bd0e38fa0c755c558
Instruction Fuzzy Hash: 802105312016058F8710DF68E9C496FF3B9EF90752B204D9EEA12A3251D730ED4C8BA5

Function 00E805C0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

memset.MSVCR90 ref: 00E805E3
wcsncpy.MSVCR90 ref: 00E805F3
CreateFontIndirectW.GDI32 ref: 00E8062C

Part of subcall function 00E804E0: GetDC.USER32(00000000), ref: 00E804E6
Part of subcall function 00E804E0: SelectObject.GDI32(00000000,?), ref: 00E804F4
Part of subcall function 00E804E0: GetOutlineTextMetricsW.GDI32(00000000,00000000,00000000,?,00E80645,00000000,00000058), ref: 00E80507
Part of subcall function 00E804E0: memset.MSVCR90 ref: 00E80527
Part of subcall function 00E804E0: GetOutlineTextMetricsW.GDI32(00000000,00000000,00000000,?,?,?,?), ref: 00E80538
Part of subcall function 00E804E0: SelectObject.GDI32(00000000,?), ref: 00E80578
Part of subcall function 00E804E0: ReleaseDC.USER32(00000000,00000000), ref: 00E80581

DeleteObject.GDI32(?), ref: 00E8064D

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Object$MetricsOutlineSelectTextmemset$CreateDeleteFontIndirectReleasewcsncpy
String ID:
API String ID: 3039118469-0
Opcode ID: 93cd763379bc1da097db8e701c26ba3789851b3039f9331ed2c2392aac5ccbc6
Instruction ID: d784197e39c44196250623d5214c1f79d62593fc80f512aa49d7f1de4fb98511
Opcode Fuzzy Hash: 93cd763379bc1da097db8e701c26ba3789851b3039f9331ed2c2392aac5ccbc6
Instruction Fuzzy Hash: F5219F705087409FD320DB69C805B6BBBE4AFC8B08F04490DF59A97641D774E909CBA2

Function 00EA73C8 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCR90(?,StartData,00000009), ref: 00EA73E8
strncmp.MSVCR90(?,/sfnts,00000006), ref: 00EA7403
strncmp.MSVCR90(?,(Hex),00000005), ref: 00EA7490
atol.MSVCR90(?), ref: 00EA749E

Strings

/sfnts, xrefs: 00EA73FD
StartData, xrefs: 00EA73E2

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: strncmp$atol
String ID: /sfnts$StartData
API String ID: 4253204224-3427144809
Opcode ID: 8bf9d430af3f81a201b3b28148df8ee8eee896e19dad2d4f4595eff8ccc3a6b6
Instruction ID: 47a84759bdeed014b5900876bebac71e3026f88b46788557c28d882ceefe6034
Opcode Fuzzy Hash: 8bf9d430af3f81a201b3b28148df8ee8eee896e19dad2d4f4595eff8ccc3a6b6
Instruction Fuzzy Hash: CB01A1305483065BD730DE208C41B6BB7E4AF8A754F041518ED88A6241F779FA1987A6

Function 00E7BA20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCR90 ref: 00E7BA36
_wcsicmp.MSVCR90 ref: 00E7BA52

Strings

SimSun, xrefs: 00E7BA30
Tahoma, xrefs: 00E7BA4C

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _wcsicmp
String ID: SimSun$Tahoma
API String ID: 2081463915-3887695749
Opcode ID: 13e40754a0443c2687c2fc2049e0e75ea085a0daa005d6e366658e9fc6bec3af
Instruction ID: cbb6d1fdbf509e92a0e8e7b578362ca8ad3945ad6c731b8a0e5ea48176eb5d1f
Opcode Fuzzy Hash: 13e40754a0443c2687c2fc2049e0e75ea085a0daa005d6e366658e9fc6bec3af
Instruction Fuzzy Hash: F7E02663381224378E10A9ACBC828CF7748CE816363455013E904A6210D214D24B87E2

Function 00FE1440 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

luaL_checknumber.XLLUARUNTIME(?,00000001,?), ref: 00FE1450

Part of subcall function 00FD7190: lua_tonumber.XLLUARUNTIME(?,?), ref: 00FD719F
Part of subcall function 00FD7190: lua_isnumber.XLLUARUNTIME(?,?), ref: 00FD71BA
Part of subcall function 00FD7190: lua_typename.XLLUARUNTIME(?,00000003), ref: 00FD71CA
Part of subcall function 00FD7190: lua_type.XLLUARUNTIME(?,?,?,00000003), ref: 00FD71D3
Part of subcall function 00FD7190: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000003), ref: 00FD71DA
Part of subcall function 00FD7190: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000003), ref: 00FD71EF

modf.MSVCR90 ref: 00FE1458
lua_pushnumber.XLLUARUNTIME(?), ref: 00FE146D
lua_pushnumber.XLLUARUNTIME(?), ref: 00FE147D

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_pushnumberlua_typename$L_argerrorL_checknumberlua_isnumberlua_tonumberlua_typemodf
String ID:
API String ID: 3842637937-0
Opcode ID: 11cbbf55dbc7256786c4f30251b761c774770690e2bac3e2959d92e254a8cbe7
Instruction ID: 564915d3d1cb5a8c6a22bb651b9c6edf11a4b8cf94ef1949c6d62d1dc30e1145
Opcode Fuzzy Hash: 11cbbf55dbc7256786c4f30251b761c774770690e2bac3e2959d92e254a8cbe7
Instruction Fuzzy Hash: E2E06D70418916D3E700BF08AC469AEBBA8EF84704F840CA5F4D051252EB36953883CB

Function 00E66160 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

XL_CaclExp.MSVCR90(?,?,00E65809,?,?,?,?,?,?,?,00E4EB76,?,?), ref: 00E6616C
XL_GetExpValue.MSVCR90(00000000,?,?,00E65809,?,?,?,?,?,?,?,00E4EB76,?,?), ref: 00E66174
XL_CaclExp.MSVCR90(?,?,00E65809,?,?,?,?,?,?,?,00E4EB76,?,?), ref: 00E66184
XL_GetExpValue.MSVCR90(?,?,?,00E65809,?,?,?,?,?,?,?,00E4EB76,?,?), ref: 00E6618D

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: CaclValue
String ID:
API String ID: 3266023997-0
Opcode ID: 67576a8b067f00baa465853a7f738d1b91d78d0efe6a47ade14acc1e2da1ab65
Instruction ID: e7a7c3cd58ae2a98f395dbfd5f3b99d1f288b1b35b4ec1a91376a05c24274971
Opcode Fuzzy Hash: 67576a8b067f00baa465853a7f738d1b91d78d0efe6a47ade14acc1e2da1ab65
Instruction Fuzzy Hash: 2DE01AB06103005BCB20EF78D540E0777E89F44340B00981DB4D9EB202D635E8418B60

Function 00E7C340 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E7C344
GetDeviceCaps.GDI32(00000000,00000058), ref: 00E7C355
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E7C360
ReleaseDC.USER32(00000000,00000000), ref: 00E7C36B

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 608ef5217a7583b2373dc220e8d76eaee8b6822a6384f05d9ca36b930813c509
Instruction ID: 2d19a1c8ae0fc90a1cd81b7be69230084a878bba7cd0332ed515b9982516bfe4
Opcode Fuzzy Hash: 608ef5217a7583b2373dc220e8d76eaee8b6822a6384f05d9ca36b930813c509
Instruction Fuzzy Hash: 4BE04F35642310AFD3105F76AC08F8BBBA8EF96721F014406F604AB2E0C6B0550A8FA2

Function 00FE14C0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

luaL_checknumber.XLLUARUNTIME(?,00000001), ref: 00FE14CB

Part of subcall function 00FD7190: lua_tonumber.XLLUARUNTIME(?,?), ref: 00FD719F
Part of subcall function 00FD7190: lua_isnumber.XLLUARUNTIME(?,?), ref: 00FD71BA
Part of subcall function 00FD7190: lua_typename.XLLUARUNTIME(?,00000003), ref: 00FD71CA
Part of subcall function 00FD7190: lua_type.XLLUARUNTIME(?,?,?,00000003), ref: 00FD71D3
Part of subcall function 00FD7190: lua_typename.XLLUARUNTIME(?,00000000,?,?,?,00000003), ref: 00FD71DA
Part of subcall function 00FD7190: luaL_argerror.XLLUARUNTIME(?,?,00000000,?,%s expected, got %s,00000000,00000000,?,00000000,?,?,?,00000003), ref: 00FD71EF

luaL_checknumber.XLLUARUNTIME(?,00000002,?,00000001), ref: 00FE14D7
_CIpow.MSVCR90 ref: 00FE14E5
lua_pushnumber.XLLUARUNTIME(?), ref: 00FE14F1

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_checknumberlua_typename$IpowL_argerrorlua_isnumberlua_pushnumberlua_tonumberlua_type
String ID:
API String ID: 542004656-0
Opcode ID: e2328454e4d8d125bf8650fccb539015148475b6fea99d1306d09e931a13612c
Instruction ID: 154a06856673bcf01e048595564c804ec571bf834de2503d66997015a63282fa
Opcode Fuzzy Hash: e2328454e4d8d125bf8650fccb539015148475b6fea99d1306d09e931a13612c
Instruction Fuzzy Hash: CBE0CD26C1561172D601762C7C43ADE36549F45705F880C55F99415242FB6A063D43E7

Function 00FD65B0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_where.XLLUARUNTIME(?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?,?,?,?,?,00FCF237,?), ref: 00FD65B8

Part of subcall function 00FD6520: lua_getstack.XLLUARUNTIME(?,?,?,?), ref: 00FD653E
Part of subcall function 00FD6520: lua_getinfo.XLLUARUNTIME(?,00FF1C64,?,?,?,?), ref: 00FD6555

lua_pushvfstring.XLLUARUNTIME(?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65C8
lua_concat.XLLUARUNTIME(?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D0
lua_error.XLLUARUNTIME(?,?,00000002,?,?,00FD6F68,?,00000001,?,00FD6F68,?,bad argument #%d to '%s' (%s),?,?,?), ref: 00FD65D6

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_wherelua_concatlua_errorlua_getinfolua_getstacklua_pushvfstring
String ID:
API String ID: 1778428932-0
Opcode ID: 97767dbc517b86c9531ce5ff6b439150677b5ebac9b2fab18251a9a79ce4d9ab
Instruction ID: 63f1b59451a4b0ba315196a4238a9af670c6d289227c8d44a91a4e93ba156987
Opcode Fuzzy Hash: 97767dbc517b86c9531ce5ff6b439150677b5ebac9b2fab18251a9a79ce4d9ab
Instruction Fuzzy Hash: 4ED05E3210652276D901B710AC43FDF364E8F49700F080006F100A6282E658BE8253EB

Function 00FC2020 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(invalid map/set<T> iterator,E3DC3B0A,?,00000004,?,00000000), ref: 00FC2060

Part of subcall function 00FC11A0: ??0exception@std@@QAE@XZ.MSVCR90(E3DC3B0A,00000024,?,?,00FEEBA9,000000FF,00FCB998), ref: 00FC11C8
Part of subcall function 00FC11A0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00FC11E4

_CxxThrowException.MSVCR90(?,00FF4CF4), ref: 00FC208E

Strings

invalid map/set<T> iterator, xrefs: 00FC2057

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: invalid map/set<T> iterator
API String ID: 3995155753-152884079
Opcode ID: 9785dbb134f0313ecb1563503760f0b478ea062206db719e42a0904dcdcdffe8
Instruction ID: d49bd82d1449e2ba51fcc79fda4a3cd32bd7ea744fd0499363dc829c009d5c73
Opcode Fuzzy Hash: 9785dbb134f0313ecb1563503760f0b478ea062206db719e42a0904dcdcdffe8
Instruction Fuzzy Hash: 35A1A8B0908286DFD751CF28C681F56BBE1FF59310F18859DE4898B262C331E885EFA5

Function 00FC7010 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(invalid map/set<T> iterator,E3DC3B0A,?,00000000,?,?), ref: 00FC7050

Part of subcall function 00FC11A0: ??0exception@std@@QAE@XZ.MSVCR90(E3DC3B0A,00000024,?,?,00FEEBA9,000000FF,00FCB998), ref: 00FC11C8
Part of subcall function 00FC11A0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00FC11E4

_CxxThrowException.MSVCR90(?,00FF4CF4), ref: 00FC707E

Strings

invalid map/set<T> iterator, xrefs: 00FC7047

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: invalid map/set<T> iterator
API String ID: 3995155753-152884079
Opcode ID: 17cf9ffc95c131bcfbbc77e150157ac130ffe5d756997e5301efa1d71610a20d
Instruction ID: a77c28d4a2d0493784ccc8485510c22d2f18130ccbed362ed6cea04ac0a986b3
Opcode Fuzzy Hash: 17cf9ffc95c131bcfbbc77e150157ac130ffe5d756997e5301efa1d71610a20d
Instruction Fuzzy Hash: 75A19AB090C3869FD711EF24C681F56BBE1AF69314F18859DE4894B362C331E849EFA5

Function 00FD4040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(invalid map/set<T> iterator,E3DC3B0A,00000000,?), ref: 00FD407C

Part of subcall function 00FC11A0: ??0exception@std@@QAE@XZ.MSVCR90(E3DC3B0A,00000024,?,?,00FEEBA9,000000FF,00FCB998), ref: 00FC11C8
Part of subcall function 00FC11A0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00FC11E4

_CxxThrowException.MSVCR90(?,00FF4CF4), ref: 00FD40AA

Strings

invalid map/set<T> iterator, xrefs: 00FD4073

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: invalid map/set<T> iterator
API String ID: 3995155753-152884079
Opcode ID: 7b834d36668cdf64ba2c3dd5ef8e22ff42336ac3ce0ec5382b46be840c2d4146
Instruction ID: 0c13cfff1a7a483bd0f3bd4da10209f209135c1ddb9fe94f359d7e533899427e
Opcode Fuzzy Hash: 7b834d36668cdf64ba2c3dd5ef8e22ff42336ac3ce0ec5382b46be840c2d4146
Instruction Fuzzy Hash: 34A15C71A08281DFDB16CF14C490A15BBE3AF65314F2C859EE4858B362C771ED89EBD2

Function 00EC6530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::_Condition_variable::_Condition_variable.LIBCMTD ref: 00EC653F
_Immortalize.LIBCPMTD ref: 00EC6561

Strings

a, xrefs: 00EC6554, 00EC6557

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Concurrency::details::_Condition_variableCondition_variable::_Immortalize
String ID: a
API String ID: 1411628985-1016852433
Opcode ID: cfc4d89d8eb1692358c058949e1421e3caa2a4b6c88273488287515db105f398
Instruction ID: 6804e057c5eba8a8ba77e765694f84831f687e58f3174c09df3cef4a98b0d244
Opcode Fuzzy Hash: cfc4d89d8eb1692358c058949e1421e3caa2a4b6c88273488287515db105f398
Instruction Fuzzy Hash: 62213D709081599BCF09EFA4CA51FEFBBB4AF54304F04511DE5527B285DB366A0BCBA0

Function 00E8E830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_setjmp3.MSVCR90 ref: 00E8E847

Part of subcall function 00E8DAC0: longjmp.MSVCR90(?,00000001,?,?,00E8E884), ref: 00E8DB02

Strings

, xrefs: 00E8E85D
@, xrefs: 00E8E8A2

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: _setjmp3longjmp
String ID: $@
API String ID: 848167055-3947257237
Opcode ID: 2313cfd27539b42490e68f6b2aa268b0094b559f9f96918cdf8e67241b91b8d4
Instruction ID: abf9b5b3bcad330437281445da60bc9fa0ccfdf94b227450cf60fd332b9fe73c
Opcode Fuzzy Hash: 2313cfd27539b42490e68f6b2aa268b0094b559f9f96918cdf8e67241b91b8d4
Instruction Fuzzy Hash: 28014071A05204DBC714EF59E941B9AB7E8FF48304F18819DE94DA7341E731EE00CB95

Function 00E4D170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

XLFS_CreateStreamFromMemory.XLFSIO(?,?,?,?,?,00E4E0C6,?,?,?,?), ref: 00E4D197

Part of subcall function 00E4CBF0: InterlockedDecrement.KERNEL32(00000004), ref: 00E4CBF8

XLFS_ReleaseStream.XLFSIO(00000000,?,?,?,?,00E4E0C6,?,?,?,?), ref: 00E4D1C2

Strings

test.png, xrefs: 00E4D179

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Stream$CreateDecrementFromInterlockedMemoryRelease
String ID: test.png
API String ID: 584912420-702945454
Opcode ID: e0eaa9236bb440d04b82a5b361da9041209a320428ab14c2e9aeeffca8fc43f2
Instruction ID: c80c8954f097c3417aa50464ca0dff985b67334114e02c142044403638ef8003
Opcode Fuzzy Hash: e0eaa9236bb440d04b82a5b361da9041209a320428ab14c2e9aeeffca8fc43f2
Instruction Fuzzy Hash: 9FF0963670A2156F9211DA29BC40D6FA7ECDBD8750711891BFD81E3355DA70DC4286A1

Function 00E4D220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D110: PathFindExtensionW.SHLWAPI(?,?,?,?,?,00E4D186,?,?,00E4E0C6,?,?,?,?), ref: 00E4D11B

XLFS_CreateStreamFromMemory.XLFSIO(?,?,?,test.png), ref: 00E4D23C
XLFS_ReleaseStream.XLFSIO(00000000,?,?,test.png), ref: 00E4D267

Strings

test.png, xrefs: 00E4D221

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: Stream$CreateExtensionFindFromMemoryPathRelease
String ID: test.png
API String ID: 287748794-702945454
Opcode ID: 3c6c0555188a11af35898a332e43404e04aaf2195aa763a12df933edaff636db
Instruction ID: 7e4203dd0973100386cbd63889b61c62fb3714f28322b8fd78b1a3ef8d6ae153
Opcode Fuzzy Hash: 3c6c0555188a11af35898a332e43404e04aaf2195aa763a12df933edaff636db
Instruction Fuzzy Hash: 16F08976709511AF8211DB69FC44D6FE7E9DBD8760311891FF940E7354C970DC0686B1

Function 00E7A840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(list<T> too long,61C1F77A,?,000000FF,00E7BFA8,00000001,?,?,?,?,?,00000000,?,?,00E7C4C7,?), ref: 00E7A87F

Part of subcall function 00E4CEB0: ??0exception@std@@QAE@XZ.MSVCR90(61C1F77A,?,?,?,00ED1429,000000FF,00E4CF5D,?,?,00ECDCE6,?), ref: 00E4CED8
Part of subcall function 00E4CEB0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90 ref: 00E4CEF4

_CxxThrowException.MSVCR90(?,00EEAF50), ref: 00E7A8AD

Strings

list<T> too long, xrefs: 00E7A876

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: list<T> too long
API String ID: 3995155753-4027344264
Opcode ID: cea488fb44f7e492ac3d7730b3ef6a02a34d1cb8c01b7fb2ea924730385eb942
Instruction ID: d69b23286ee1032c96bef0e7ef248756cb4d139ea9422a9609cb5517e718f35b
Opcode Fuzzy Hash: cea488fb44f7e492ac3d7730b3ef6a02a34d1cb8c01b7fb2ea924730385eb942
Instruction Fuzzy Hash: 6E0184765083409FC304DF28C841B56F7E4EB98724F148B2FF469A3390E731A905CB42

Function 00E81010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(list<T> too long,61C1F77A,00000004), ref: 00E8104F

Part of subcall function 00E4CEB0: ??0exception@std@@QAE@XZ.MSVCR90(61C1F77A,?,?,?,00ED1429,000000FF,00E4CF5D,?,?,00ECDCE6,?), ref: 00E4CED8
Part of subcall function 00E4CEB0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90 ref: 00E4CEF4

_CxxThrowException.MSVCR90(?,00EEAF50), ref: 00E8107D

Strings

list<T> too long, xrefs: 00E81046

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: list<T> too long
API String ID: 3995155753-4027344264
Opcode ID: 6fd0b3539ae99130010f63c8ee818bd77f45974db5c59ee75ac62216ad7ec17d
Instruction ID: 053a993904163749a7ac3a054ef35d8f1c03b018ecf6df385cb694e3c636f885
Opcode Fuzzy Hash: 6fd0b3539ae99130010f63c8ee818bd77f45974db5c59ee75ac62216ad7ec17d
Instruction Fuzzy Hash: C20184765083409FC304EB28C841B56F7E4EB98724F148B1FF469A3390E731A505CB42

Function 00FD04E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(list<T> too long,E3DC3B0A,?,?,?,?,?,00000000,00FEF789,000000FF,00FCE5CD,00000001,?,?,?,?), ref: 00FD051F

Part of subcall function 00FC11A0: ??0exception@std@@QAE@XZ.MSVCR90(E3DC3B0A,00000024,?,?,00FEEBA9,000000FF,00FCB998), ref: 00FC11C8
Part of subcall function 00FC11A0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90(?), ref: 00FC11E4

_CxxThrowException.MSVCR90(?,00FF4AD0), ref: 00FD054D

Strings

list<T> too long, xrefs: 00FD0516

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: list<T> too long
API String ID: 3995155753-4027344264
Opcode ID: 84592e97afc151bd34600fb0027b7efe3e14e508a27215ede7a815ea7b4afdab
Instruction ID: 01e8f57c00ea532915170f1646f8223e952405d16c315dc2e0c3cebd709b6116
Opcode Fuzzy Hash: 84592e97afc151bd34600fb0027b7efe3e14e508a27215ede7a815ea7b4afdab
Instruction Fuzzy Hash: 0601B1B6508244DFC300DF28C881B5ABBE8FF88714F14872EF55993290EB74E504CA42

Function 00E534D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP90(vector<T> too long,61C1F77A,?,?,?,?,?,?,?,?,?,?,00ED17C9,000000FF,00E4D454,61C1F77A), ref: 00E534FC

Part of subcall function 00E4CEB0: ??0exception@std@@QAE@XZ.MSVCR90(61C1F77A,?,?,?,00ED1429,000000FF,00E4CF5D,?,?,00ECDCE6,?), ref: 00E4CED8
Part of subcall function 00E4CEB0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z.MSVCP90 ref: 00E4CEF4

_CxxThrowException.MSVCR90(?,00EEAF50), ref: 00E5352A

Strings

vector<T> too long, xrefs: 00E534F3

Memory Dump Source

Source File: 00000007.00000002.1785646943.0000000000E41000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.1785612213.0000000000E40000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785750191.0000000000ED3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785811596.0000000000EF0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785846920.0000000000F40000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.1785899875.0000000000F43000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_thelper.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0exception@std@@ExceptionThrowV01@@
String ID: vector<T> too long
API String ID: 3995155753-3788999226
Opcode ID: a5d058992e6e0f0c1f3d9c2074bcc906cd43d944955430c6d32d25831300ecce
Instruction ID: 91526c6792aabb2084d42bd388c0a560acf23ab980b07c6bf841b38997ca80a3
Opcode Fuzzy Hash: a5d058992e6e0f0c1f3d9c2074bcc906cd43d944955430c6d32d25831300ecce
Instruction Fuzzy Hash: 2DF08CB5108340ABC304EB65CA42F6BB7E8EB48B14F001A1EF056A2290DB74A609CA12

Function 00FD70A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

lua_type.XLLUARUNTIME(?,?), ref: 00FD70AC
luaL_argerror.XLLUARUNTIME(?,?,value expected), ref: 00FD70C0

Part of subcall function 00FD6E80: lua_getstack.XLLUARUNTIME(?,00000000,00FCF237,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1,?,00FCF237), ref: 00FD6EA0
Part of subcall function 00FD6E80: luaL_error.XLLUARUNTIME(?,bad argument #%d (%s),?,?,?,00FCF237,?,?,?,?,?,?,?,?,?,00FD6FB1), ref: 00FD6EB8

Strings

value expected, xrefs: 00FD70B9

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: L_argerrorL_errorlua_getstacklua_type
String ID: value expected
API String ID: 3446470471-841185261
Opcode ID: 0ea16442e5ad7c55531b6c75d3cb36b9cfd84b7334282fc75d4f22558fc3c1c1
Instruction ID: 823155a14ced532d66a1aac437afe8b58cc43bda482ac795801314aef7924976
Opcode Fuzzy Hash: 0ea16442e5ad7c55531b6c75d3cb36b9cfd84b7334282fc75d4f22558fc3c1c1
Instruction Fuzzy Hash: 9FD0A72BC0512036851022157C018AF776D4DE2736F084617F128A32D1D234540561F3

Function 00FC3010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

lua_newuserdata.XLLUARUNTIME(?,00000004,00000000,00FD03C2,?,00000000), ref: 00FC3018
lua_setfield.XLLUARUNTIME(?,FFFFD8F0,XLLRT_RUNTIME,?,00000004,00000000,00FD03C2,?,00000000), ref: 00FC302E

Strings

XLLRT_RUNTIME, xrefs: 00FC3021

Memory Dump Source

Source File: 00000007.00000002.1786253448.0000000000FC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000007.00000002.1786182282.0000000000FC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786326926.0000000000FF1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786366957.0000000000FF9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1786408688.0000000000FFB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_thelper.jbxd

Similarity

API ID: lua_newuserdatalua_setfield
String ID: XLLRT_RUNTIME
API String ID: 1083176672-3692059069
Opcode ID: 4453fbb753de5d66bdf8a35cffecba2ea243a5d6c833cf25f3891158361f3c10
Instruction ID: 3e9f8160094264335e7af0580003addc51e8deaf0d3c82c4e696ec1fa5d20580
Opcode Fuzzy Hash: 4453fbb753de5d66bdf8a35cffecba2ea243a5d6c833cf25f3891158361f3c10
Instruction Fuzzy Hash: 8AD022760583306AC600AA08AC02ECF33881F85B00F0D044AF3012B391CA79A801A7F6

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5559fb.rbs

C:\ProgramData\Microsoft\MF\Mi.jpg

C:\ProgramData\Microsoft\MF\Microsoft.VC90.ATL.manifest

C:\ProgramData\Microsoft\MF\Microsoft.VC90.CRT.manifest

C:\ProgramData\Microsoft\MF\XLFSIO.dll

C:\ProgramData\Microsoft\MF\XLFSIO2.dll

C:\ProgramData\Microsoft\MF\XLGraphic.dll

C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

C:\ProgramData\Microsoft\MF\XLUE.dll

C:\ProgramData\Microsoft\MF\atl90.dll

C:\ProgramData\Microsoft\MF\ic.dll

C:\ProgramData\Microsoft\MF\libexpat.dll

Windows Analysis Report
WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre